CVE-2026-89639

Received Received - Intake

Use of cifs_invalidate_cache in cifs_do_truncate for O_TRUNC in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC cifs_do_truncate() is invoked from cifs_open() without i_rwsem, so it cannot use cifs_resize_file_locked() to perform a proper fscache cookie resize. Instead, add cifs_invalidate_cache() after cifs_setsize(). cifs_invalidate_cache() calls fscache_invalidate(), which works without holding i_rwsem: it unconditionally increments inval_counter and sets FSCACHE_COOKIE_NO_DATA_TO_READ, ensuring that stale cached data is not served once the cookie is later activated by fscache_use_cookie(). Truncation to zero leaves no valid cached data, making invalidation the correct semantic here.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89639

EUVD

EUVD-2026-76551

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
samba	cifs	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper cache handling in the CIFS (Common Internet File System) module. When a file is truncated using the O_TRUNC flag, the system fails to properly invalidate cached data, which could lead to stale data being served after the file size is reduced.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS (Common Internet File System) implementation. Detection requires checking the kernel version and CIFS module behavior. Use commands like 'uname -r' to check the kernel version and 'lsmod | grep cifs' to verify if the CIFS module is loaded. If the kernel version is vulnerable, monitor for unexpected file truncation or cache inconsistencies in CIFS shares.

Impact Analysis

If exploited, this flaw could allow an attacker to read outdated or incorrect data from a file after it has been truncated, potentially leading to information disclosure or corruption of data being processed by the system.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive data to unauthorized access, violating confidentiality requirements in standards like GDPR and HIPAA. Proper data integrity and access controls are essential for compliance.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the CIFS module temporarily or restricting access to CIFS shares until the update is applied. Monitor system logs for signs of exploitation or unusual file operations.

Hi! I’m here to help you understand CVE-2026-89639. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70