CVE-2026-89639

HighCVSS 7.1

Published: 11/09/2026(UTC)Updated: 19/10/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

In the Linux kernel CIFS client, cifs_do_truncate() invoked from cifs_open() with O_TRUNC cannot use cifs_resize_file_locked() because i_rwsem is not held, so it fails to properly resize the fscache cookie. The fix adds a cifs_invalidate_cache() call after cifs_setsize(), which invalidates the cache without requiring i_rwsem.

Risk Assessment

Without the fix, stale cached data may be served after a file is truncated to zero, leading to reads of old file contents.

Recommendation

Update the Linux kernel to a version containing the fix that calls cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC operations.

Other vulnerabilities in Linux kernel (CIFS client)

CVE-2026-89640High
In the Linux kernel CIFS client, cifs_remap_file_range() with len == 0 (clone to EOF) computes the effective length as i_size - off. If off exceeds the file size, the result is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check only fires after the ioctl has already been sent.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC cifs_do_truncate() is invoked from cifs_open() without i_rwsem, so it cannot use cifs_resize_file_locked() to perform a proper fscache cookie resize. Instead, add cifs_invalidate_cache() after cifs_setsize(). cifs_invalidate_cache() calls fscache_invalidate(), which works without holding i_rwsem: it unconditionally increments inval_counter and sets FSCACHE_COOKIE_NO_DATA_TO_READ, ensuring that stale cached data is not served once the cookie is later activated by fscache_use_cookie(). Truncation to zero leaves no valid cached data, making invalidation the correct semantic here.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS