Cloudanix VulnDB

CVE-2026-89641

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux code that talks to Windows file shares can let a local user on the same computer crash the system or possibly run code they should not be allowed to run.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Use-after-free in the Linux kernel CIFS driver: cifs_file_set_size() borrows tcon/server from a writable file handle, releases the handle via cifsFileInfo_put(), then reuses the (now-freed) tcon on the path-based fallback when set_file_size() fails because the NULL guard is skipped.

Why it matters to the business

Local attackers on systems mounting CIFS/SMB shares can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation that disrupts file-sharing workloads and requires emergency reboots or kernel updates.

How an attack unfolds

A local user with write access to a CIFS-mounted share crafts file operations that cause the handle-based set_file_size() RPC to fail; execution then falls through to the path-based code path that reuses a tcon freed by the preceding cifsFileInfo_put() during reconnection or teardown, resulting in a use-after-free.

How to fix it

Apply the upstream kernel patch that adds "tcon = NULL;" immediately after cifsFileInfo_put() in cifs_file_set_size(); rebuild and reboot to the fixed kernel. Disable CIFS mounts where feasible until patched. Monitor vendor backports for distribution kernels.

How to confirm the fix worked

Inspect the cifs.c source for the explicit "tcon = NULL" assignment after cifsFileInfo_put() in cifs_file_set_size(); verify the running kernel contains the commit or is newer than the vulnerable version; attempt to reproduce the failing set_size path in a test mount and confirm no use-after-free in dmesg or KASAN.

Typical attack path

  1. Obtain local shell or unprivileged process on a Linux system with CIFS mounts
  2. Open a writable file on a CIFS share and trigger conditions that cause find_writable_file() to succeed
  3. Force set_file_size() RPC to fail (network error, server rejection, or session state change)
  4. Execute the fallback set_path_size() path that dereferences the already-freed tcon
  5. Achieve memory corruption, crash, or code execution via the freed object

How to detect it

Search kernel logs (dmesg, journalctl) for CIFS use-after-free reports, KASAN splats, or oops referencing cifs_file_set_size and tcon; correlate with file operations on SMB mounts around the time of crashes; review audit logs for unusual set-size or truncate activity on CIFS paths.

What your security team should do

  • Inventory all Linux systems mounting CIFS shares and prioritize kernel updates
  • Apply patches within normal change windows given low EPSS and absence from KEV
  • Consider temporary mitigation by mounting with stricter caching or read-only options if updates are delayed
  • Add kernel crash and CIFS error logging to SOC monitoring for post-patch validation

The record

In the Linux kernel, the following vulnerability has been resolved: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() When the else branch of cifs_file_set_size() finds a writable file handle via find_writable_file(), it borrows tcon and server from the handle's tlink, attempts the handle-based set_file_size() RPC, and then releases the handle with cifsFileInfo_put(). If set_file_size() fails, execution falls through to the path-based fallback, which reuses the borrowed tcon and server under the "if (tcon == NULL)" guard. Since tcon is not NULL at that point, the guard is skipped. If cifsFileInfo_put() dropped the last reference on a tlink that was already removed from the tlink tree (TCON_LINK_IN_TREE cleared, as happens during reconnection or session teardown), cifs_put_tlink() will have freed tcon; the subsequent set_path_size() call is then a use-after-free. Setting tcon = NULL after cifsFileInfo_put() causes the existing guard to take the cifs_sb_tlink() path, which acquires a fresh reference for the path-based operation or fails cleanly if the session is gone.

Affected packages

Ecosystem Package Introduced Fixed