CVE-2026-98682

A flaw was found in the Linux kernel's Server Message Block (SMB) client subsystem. Due to improper synchronization during server-side file copy and clone operations, pending write operations are not drained before copying begins. A local user could exploit this timing issue during copy operations to overwrite newly copied data with stale data, resulting in file corruption.

The SMB client does not fully serialize server-side copy or clone operations against asynchronous writeback and cached pages for the destination file. An in-flight destination write can complete after the server has copied or cloned the requested range and can restore stale cached data over the new server-side contents. This produces persistent destination file corruption and was observed during generic/363 testing against Windows Server. For the CVSS the PR:L because a local user or process with access to the SMB mount and permission to copy or clone into the destination can reach the affected paths without administrative capabilities. AC:H applies because successful triggering depends on a timing window between asynchronous destination I/O and the server-side operation. The issue is not directly reachable through unsolicited network traffic because the vulnerable operation is initiated on the SMB client, although the affected file and copy operation involve a remote SMB server. The confirmed impact is integrity loss through file corruption. There is no supported kernel memory corruption or information disclosure primitive. The worst still defensible availability impact is loss of access to corrupted application data rather than a kernel crash or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.