Cloudanix VulnDB

CVE-2026-99111

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux file handling over network shares can cause some saved data to disappear without warning when multiple programs write to the same file at once.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in CIFS client truncate path allows concurrent buffered writes to dirty pages after flush but before local pagecache truncation, resulting in silent data loss when pages are discarded.

Why it matters to the business

Silent corruption of files written over SMB shares can cause application failures, lost work, and require manual data recovery, with urgency elevated by recent publication requiring prompt kernel updates across Linux fleets.

How an attack unfolds

An attacker with local access on a Linux SMB client triggers concurrent netfs writes and O_TRUNC operations on the same file; the missing inode and invalidate locks permit writes to race with cifs_do_truncate, discarding newly dirtied pages and corrupting file contents.

How to fix it

Upgrade to a kernel containing the fix for CVE-2026-99111 that acquires inode_lock and filemap_invalidate_lock at the start of cifs_do_truncate; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm presence of the locking change in cifs_do_truncate in the running kernel source or binary; test concurrent write-plus-truncate workloads on SMB mounts to verify no data loss occurs.

Typical attack path

  1. Mount remote SMB share on Linux client
  2. Open file for write with O_TRUNC while other threads perform buffered writes
  3. Trigger cifs_do_truncate without holding exclusive i_rwsem or invalidate_lock
  4. Observe silent discard of post-flush dirty pages leading to data loss

How to detect it

Search system and audit logs for repeated truncate and write sequences on CIFS-mounted files; examine kernel traces or cifs module logs for evidence of pagecache truncation without proper locking around the time of reported corruption.

What your security team should do

  • Prioritize kernel updates on all Linux systems mounting SMB shares within the CISA remediation window if applicable
  • Audit workloads performing concurrent writes and truncates over CIFS
  • Monitor vendor kernel advisories for the exact fixed version

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and O_TRUNC cifs_do_truncate() flushes dirty pages with filemap_write_and_wait() and truncates the file on the server, but in the old code both operations ran without holding i_rwsem or invalidate_lock. A concurrent buffered write via netfs_perform_write() -- which only needs i_rwsem shared -- could dirty new pages after the flush but before the local truncation, and those pages would be silently discarded by cifs_setsize() -> truncate_pagecache(). Fix by acquiring inode_lock (exclusive i_rwsem) and filemap_invalidate_lock at the top of cifs_do_truncate(), so the entire flush-truncate-resize sequence is atomic with respect to: - buffered writes (blocked by exclusive i_rwsem, since netfs_start_io_write takes i_rwsem shared), - read page faults (blocked by exclusive invalidate_lock, since filemap_fault takes it shared), - writeback collection (blocked by netfs_wb_begin/netfs_wb_end around the server truncate and local resize, since netfs_writepages also acquires the wb lock).

Affected packages

Ecosystem Package Introduced Fixed