From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-89639: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
Date: Fri, 11 Sep 2026 21:45:28 +0200 [thread overview]
Message-ID: <2026091141-CVE-2026-89639-ae1d@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
cifs_do_truncate() is invoked from cifs_open() without i_rwsem, so it
cannot use cifs_resize_file_locked() to perform a proper fscache cookie
resize. Instead, add cifs_invalidate_cache() after cifs_setsize().
cifs_invalidate_cache() calls fscache_invalidate(), which works without
holding i_rwsem: it unconditionally increments inval_counter and sets
FSCACHE_COOKIE_NO_DATA_TO_READ, ensuring that stale cached data is not
served once the cookie is later activated by fscache_use_cookie().
Truncation to zero leaves no valid cached data, making invalidation the
correct semantic here.
The Linux kernel CVE team has assigned CVE-2026-89639 to this issue.
Affected and fixed versions
===========================
Issue introduced in 6.18.44 with commit efbcecdecefc26fa062c0e8210533ccad7d6bd4a and fixed in 6.18.50 with commit 8b9b10fe5b8b492b27b9f4546742ea541a650213
Issue introduced in 7.2 with commit fa724e235cfdb0fb0bb427d0f9dfe864ae27403e and fixed in 7.2.4 with commit 81fc3868a7f726980ff845c1d0d271051e5f0f45
Issue introduced in 7.2 with commit fa724e235cfdb0fb0bb427d0f9dfe864ae27403e and fixed in 7.3-rc1 with commit 364b183230586a62660a7280c1eb20138338eeb5
Issue introduced in 6.12.105 with commit 6838bcac954487cc0a3c8a4ee1b3a3a30e244dc9
Issue introduced in 6.18.51 with commit 75640976cf474eb41682a13f2dbe9534ac26ca50
Issue introduced in 7.1.8 with commit 3513f3931c579ba2a715784c6dedc59e0d9282ee
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-89639
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
fs/smb/client/file.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/8b9b10fe5b8b492b27b9f4546742ea541a650213
https://git.kernel.org/stable/c/81fc3868a7f726980ff845c1d0d271051e5f0f45
https://git.kernel.org/stable/c/364b183230586a62660a7280c1eb20138338eeb5
reply other threads:[~2026-09-11 20:00 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026091141-CVE-2026-89639-ae1d@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox