CVE-2026-89642

What it actually does

Missing call to pagecache_isize_extended() in cifs_setsize() allows dirty bytes from the page straddling the old EOF to be written back to the server after a file extension, leaking stale data into the newly extended range.

Why it matters to the business

Organizations using Linux systems with CIFS/SMB client mounts risk unintended exposure of prior file contents to remote servers, potentially violating data handling policies or enabling information leaks in shared environments.

How an attack unfolds

An attacker with local access triggers a file size extension through CIFS operations on a mounted share; the kernel skips zeroing the tail page, so subsequent write-back sends stale cached data to the server where it becomes visible in the extended region.

How to fix it

Apply the upstream kernel commit that adds the pagecache_isize_extended() call inside cifs_setsize() before truncate_pagecache(); rebuild and reboot to the patched kernel version.

How to confirm the fix worked

Confirm the fix by inspecting the cifs_setsize() implementation in the kernel source for the presence of the pagecache_isize_extended() call on extension paths; re-test file extension and write-back behavior with cache inspection tools.

Typical attack path

1. Mount a remote share via CIFS on a vulnerable Linux kernel
2. Perform operations that extend a file size using cifs_setsize()
3. Trigger write-back of the affected page cache region
4. Observe or retrieve the stale data now present on the remote server

How to detect it

Examine kernel logs and CIFS trace output for file extension events followed by unexpected write-back of uninitialized pages; correlate with server-side file contents showing non-zero data in newly extended regions.

What your security team should do

• Prioritize patching all Linux systems that mount CIFS shares, especially those handling sensitive data
• Monitor kernel update channels for the specific cifs fix and schedule rapid deployment
• Review CIFS mount usage to identify high-risk workloads and apply compensating controls such as disabling page cache where feasible