CVE-2026-89641

Received Received - Intake

Use-After-Free in Linux Kernel CIFS File System

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() When the else branch of cifs_file_set_size() finds a writable file handle via find_writable_file(), it borrows tcon and server from the handle's tlink, attempts the handle-based set_file_size() RPC, and then releases the handle with cifsFileInfo_put(). If set_file_size() fails, execution falls through to the path-based fallback, which reuses the borrowed tcon and server under the "if (tcon == NULL)" guard. Since tcon is not NULL at that point, the guard is skipped. If cifsFileInfo_put() dropped the last reference on a tlink that was already removed from the tlink tree (TCON_LINK_IN_TREE cleared, as happens during reconnection or session teardown), cifs_put_tlink() will have freed tcon; the subsequent set_path_size() call is then a use-after-free. Setting tcon = NULL after cifsFileInfo_put() causes the existing guard to take the cifs_sb_tlink() path, which acquires a fresh reference for the path-based operation or fails cleanly if the session is gone.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89641

EUVD

EUVD-2026-76553

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free flaw in the Linux kernel's CIFS (Common Internet File System) module. It occurs when handling file size operations in cifs_file_set_size(). The issue arises when a failed RPC operation leads to a path-based fallback that incorrectly reuses a freed tcon (tree connection) reference, causing a use-after-free when set_path_size() is called.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS (Common Internet File System) module. Detection requires checking kernel logs for CIFS-related errors or crashes, particularly during file operations involving set_file_size(). Monitor logs with commands like dmesg | grep -i cifs or journalctl -k | grep -i cifs. If the system crashes or logs show use-after-free errors in cifs operations, it may indicate exploitation.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code on a system running a vulnerable Linux kernel. It specifically affects systems using CIFS for file sharing, potentially leading to system crashes or unauthorized access if exploited.

Mitigation Strategies

Immediately update the Linux kernel to the latest stable version that includes the fix for CVE-2026-89641. If immediate patching is not possible, disable the CIFS module by unloading it with rmmod cifs or blacklisting it in /etc/modprobe.d/. Avoid using writable CIFS file handles until patched. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-89641. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70