The vulnerability arises from the Linux kernel’s SMB client not properly serializing the target file’s page cache during server-side copy and clone operations. Because the destination mapping’s invalidate_lock is released before the kernel issues the copy-chunk or clone ioctl, an asynchronous writeback can finish afterward and overwrite the freshly written data, restoring stale contents and corrupting the file. This flaw does not provide remote code execution or credential escalation; its primary consequence is unintended data loss and integrity compromise for files written over SMB by client systems.

Linux kernel builds that include the SMB/CIFS client prior to the fix. The vendor is the Linux kernel itself, covering all affected kernel versions that implement the cifs_file_copychunk_range and cifs_remap_file_range routines.

No CVSS score is supplied in the public data, but the EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable on systems using the SMB/CIFS client where background writeback of the target page cache is enabled. An attacker with local or network access that can initiate SMB copy or clone operations could deliberately trigger the race condition to overwrite fresh data, leading to file corruption. The exploit requires the client to perform a range copy or clone against a server that supports the operation; no remote code execution or privilege escalation is possible.