The vulnerability originates from the SMB/CIFS client in the Linux kernel not properly synchronizing the destination file’s page cache during server‑side copy and clone operations. Because the client flushes and invalidates the target mapping incorrectly—releasing the invalidate_lock before issuing the copy‑chunk or clone ioctl—an asynchronous writeback can finish after the server operation and restore stale data, overwriting the freshly written region and corrupting the file. The flaw does not provide remote code execution or privilege escalation, but it does compromise data integrity for SMB‑managed files.

Linux kernel builds that predate the patch, which add the SMB/CIFS client’s cifs_file_copychunk_range and cifs_remap_file_range paths, are affected. All kernel versions that include these routines in the SMB client are vulnerable until they are updated with the fix.

The CVSS score of 2.5 signals low severity, and the EPSS score of less than 1% indicates a very low probability of exploitation at this time; the vulnerability is not listed in CISA’s KEV catalog. An attacker who can perform SMB copy or clone operations against a vulnerable client can trigger the race condition and overwrite data, leading to corruption. The desired effect requires only local or network access to the SMB client and does not need special privileges or remote code execution.