Cloudanix VulnDB

CVE-2026-89639

High · 7.1

CVSS

7.1

EPSS

0.1%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in Linux file handling on network shares can let local users see or change old file data after it should have been erased.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in cifs_do_truncate allows truncation via O_TRUNC without proper fscache invalidation, leaving stale cached data that can be served after cookie reactivation.

Why it matters to the business

Local users on systems using CIFS mounts may access or modify outdated file contents that should have been cleared, creating data exposure or integrity risks on shared filesystems.

How an attack unfolds

An attacker with local access opens a CIFS file with O_TRUNC from cifs_open without holding i_rwsem, triggering cifs_setsize but skipping cache resize; the missing invalidation allows subsequent reads to return stale fscache data instead of the truncated zero-length view.

How to fix it

Update the Linux kernel to a version containing the fix that calls cifs_invalidate_cache after cifs_setsize in cifs_do_truncate; rebuild and reboot if using custom kernels.

How to confirm the fix worked

Confirm the presence of the cifs_invalidate_cache call in cifs_do_truncate in the running kernel source or binary; test by performing O_TRUNC opens on CIFS files and verifying fscache cookie invalidation counters increase.

Typical attack path

  1. Obtain local user access on a Linux system with CIFS mounts
  2. Identify or create a file on the CIFS share with active fscache
  3. Open the file using O_TRUNC flag via cifs_open
  4. Read from the file or dependent cache before full invalidation occurs
  5. Observe or manipulate stale cached data that should have been discarded

How to detect it

Review kernel audit logs and CIFS debug output for repeated truncate operations on cached files; correlate with fscache invalidation events or unexpected stale data reads in application logs.

What your security team should do

  • Prioritize kernel updates on all systems using CIFS mounts within the next patch cycle
  • Audit CIFS mount usage and fscache configuration for exposure scope
  • Monitor vendor advisories for backported fixes in distribution kernels

The record

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC cifs_do_truncate() is invoked from cifs_open() without i_rwsem, so it cannot use cifs_resize_file_locked() to perform a proper fscache cookie resize. Instead, add cifs_invalidate_cache() after cifs_setsize(). cifs_invalidate_cache() calls fscache_invalidate(), which works without holding i_rwsem: it unconditionally increments inval_counter and sets FSCACHE_COOKIE_NO_DATA_TO_READ, ensuring that stale cached data is not served once the cookie is later activated by fscache_use_cookie(). Truncation to zero leaves no valid cached data, making invalidation the correct semantic here.

Affected packages

Ecosystem Package Introduced Fixed