CVE-2026-89641

The Linux kernel's CIFS/SMB client contains a use-after-free in cifs_file_set_size(): when a handle-based set_file_size() RPC fails, the code releases the writable file handle with cifsFileInfo_put() but then falls through to a path-based fallback that reuses the borrowed tcon pointer. If that put dropped the last reference on a tlink already removed from the tlink tree (as happens during SMB reconnection or session teardown), the tcon has been freed and set_path_size() operates on freed memory. A local unprivileged attacker on a system with mounted CIFS/SMB shares can trigger the flaw by changing a file's size (e.g., truncate/ftruncate) while the session is being torn down, potentially crashing the kernel and, per the CVSS 3.1 score of 7.8, achieving confidentiality, integrity, and availability impact through kernel memory corruption. The fix sets tcon = NULL after cifsFileInfo_put() so the fallback re-acquires a fresh reference via cifs_sb_tlink() or fails cleanly; no specific affected version range was given in the advisory. No public proof of concept exists and the issue is not known to be exploited in the wild.

What to do: Apply your distribution's kernel update as soon as it includes the fix that sets tcon = NULL after cifsFileInfo_put() in cifs_file_set_size(). Until patched, restrict local untrusted accounts on machines with mounted CIFS/SMB shares, and unload or blacklist the cifs module on hosts that do not need SMB mounts. Watch kernel logs for oopses or BUG reports in cifs_file_set_size/set_path_size as a sign of exploitation attempts.