KernelScan.io

HIGH

cifs Truncate Leak

CVE-2026-89639

CVSS 7.1 / 10.0 NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

KernelScan AI5.3MEDIUM

01

In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC cifs_do_truncate() is invoked from cifs_open() without i_rwsem, so it cannot use cifs_resize_file_locked() to perform a proper fscache cookie resize. Instead, add cifs_invalidate_cache() after cifs_setsize(). cifs_invalidate_cache() calls fscache_invalidate(), which works without holding i_rwsem: it unconditionally increments inval_counter and sets FSCACHE_COOKIE_NO_DATA_TO_READ, ensuring that stale cached data is not served once the cookie is later activated by fscache_use_cookie(). Truncation to zero leaves no valid cached data, making invalidation the correct semantic here.

02

Engine v0.6.0

Risk summary

A local user with access to files on a CIFS/SMB mount can open a file with O_TRUNC, causing the filesystem cache to retain stale data after truncation because the truncation path runs without the inode lock. Subsequent readers may be served pre-truncation cached content instead of the expected empty file, leading to stale data disclosure and data integrity issues.

Affectedfs/smb/client/file.c (cifs/smb client)

Vulnerability analysis

When a file on a CIFS/SMB filesystem is opened with the O_TRUNC flag, the client truncates the file to zero but fails to properly invalidate the local filesystem cache. This leaves cached pages from before the truncation available to serve to later readers. The fix adds an explicit cache invalidation immediately after truncation, ensuring subsequent reads fetch fresh content from the server rather than returning stale cached data. Any local user who can open files on an active CIFS/SMB mount with caching enabled can trigger this by opening a file with O_TRUNC; mounting the share requires administrator setup, but the trigger is an ordinary open operation.

03

BranchIntroducedFixed inPatch commit
6.126.12.1056.1381fc3868a7f7
6.186.18.446.18.508b9b10fe5b8b
7.17.1.87.2364b18323058
7.2—7.2.4—
mainline—7.3—

04

State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.

CIP treeState
cip/6.12Affected — no CIP fix yet (latest 6.12.112-cip33)