CVE-2026-89642

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache_isize_extended() in cifs_setsize() when extending cifs_setsize() calls truncate_pagecache() but skips pagecache_isize_extended() on extension. truncate_setsize() shows the correct pattern: i_size_write(inode, newsize); if (newsize > oldsize) pagecache_isize_extended(inode, oldsize, newsize); truncate_pagecache(inode, newsize); pagecache_isize_extended() zeroes the tail of the page straddling old EOF. Without it, dirty bytes in that region can be written back to the server, exposing stale data in the newly extended range.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/12bafe32f09c0d24f5096154b59c347b9c6606e0
https://git.kernel.org/stable/c/c510edb9734af1c274d18f4f31a471a166bbc7e8

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-11 20:19

Updated : 2026-09-13 07:17

NVD link : CVE-2026-89642

Mitre link : CVE-2026-89642

CVE.ORG link : CVE-2026-89642

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-89642", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "12bafe32f09c0d24f5096154b59c347b9c6606e0", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "c510edb9734af1c274d18f4f31a471a166bbc7e8", "versionType": "git"}], "programFiles": ["fs/smb/client/inode.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.12"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.12", "versionType": "semver"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/inode.c"], "defaultStatus": "affected"}]}], "published": "2026-09-11T20:19:49.980", "references": [{"url": "https://git.kernel.org/stable/c/12bafe32f09c0d24f5096154b59c347b9c6606e0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c510edb9734af1c274d18f4f31a471a166bbc7e8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: call pagecache_isize_extended() in cifs_setsize() when extending\n\ncifs_setsize() calls truncate_pagecache() but skips\npagecache_isize_extended() on extension. truncate_setsize() shows\nthe correct pattern:\n\n i_size_write(inode, newsize);\n if (newsize > oldsize)\n pagecache_isize_extended(inode, oldsize, newsize);\n truncate_pagecache(inode, newsize);\n\npagecache_isize_extended() zeroes the tail of the page straddling old\nEOF. Without it, dirty bytes in that region can be written back to\nthe server, exposing stale data in the newly extended range."}], "lastModified": "2026-09-13T07:17:29.493", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}