CVE-2026-89639

A cache-coherence flaw in the Linux kernel's CIFS/SMB client (fs/smb/client) allowed stale FS-Cache data to be served after a file was opened with O_TRUNC on an fscache-enabled CIFS mount. cifs_do_truncate() is invoked from cifs_open() without holding i_rwsem, so it could not perform a proper fscache cookie resize, and the pre-truncation cached data was never invalidated; once the cookie was later activated by fscache_use_cookie(), reads could return data that should have been discarded. A local, low-privileged user able to open files on such a mount could read back stale content that should no longer exist (confidentiality impact) and cause applications to act on incorrect cached data (integrity impact), with no availability impact. Only Linux systems mounting SMB shares with FS-Cache enabled are affected; most CIFS mounts without the caching option are not. The flaw was fixed upstream by calling cifs_invalidate_cache() after cifs_setsize(), and there is no known public PoC or exploitation in the wild.

What to do: Update to a kernel release that includes the fix (the cifs_invalidate_cache() call added to cifs_do_truncate()); distributions will ship it through their stable kernel update channels. If patching is delayed, remount CIFS/SMB shares without FS-Cache (remove the fsc or cache= mount option) to eliminate the vulnerable code path. Review any cached CIFS-mounted systems where applications open files with O_TRUNC for signs they acted on stale file contents.