CVE-2026-89639: Linux Kernel CIFS Privilege Escalation

CVE-2026-89639 Overview

CVE-2026-89639 is a Linux kernel vulnerability in the Common Internet File System (CIFS) client. The flaw resides in cifs_do_truncate(), which is invoked from cifs_open() without holding i_rwsem. Because the function cannot safely call cifs_resize_file_locked() to perform a proper fscache cookie resize, stale cached data may be served after truncation.

The issue affects the confidentiality and integrity of cached file data on systems mounting CIFS/SMB shares with fscache enabled. Local, low-privileged users interacting with CIFS-mounted shares can trigger the condition through file operations that open files with O_TRUNC.

Critical Impact
Stale fscache data may be returned to userspace after a CIFS file is truncated via O_TRUNC, undermining data integrity on cached SMB shares.

Affected Products

Linux kernel versions containing the vulnerable cifs_do_truncate() implementation prior to the fix
Systems mounting CIFS/SMB shares with fscache enabled
Distributions shipping upstream kernels without the referenced stable backports

Discovery Timeline

2026-09-11 - CVE-2026-89639 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89639

Vulnerability Analysis

The vulnerability affects the CIFS client in the Linux kernel. When a file is opened with the O_TRUNC flag, the kernel calls cifs_do_truncate() from within cifs_open(). In this call path, i_rwsem is not held, which prevents the safe use of cifs_resize_file_locked() for updating the fscache cookie associated with the file.

Without an appropriate cache update, the fscache layer continues to expose data associated with the pre-truncation state. When the cookie is later activated by fscache_use_cookie(), reads may return stale content that no longer reflects the on-disk file. Truncation to zero leaves no valid cached data, so serving cached bytes violates file semantics.

The upstream fix replaces the improper resize with cifs_invalidate_cache() after cifs_setsize(). That function calls fscache_invalidate(), which operates without i_rwsem by unconditionally incrementing inval_counter and setting FSCACHE_COOKIE_NO_DATA_TO_READ.

Root Cause

The root cause is a locking mismatch between cifs_do_truncate() and the cache resize primitive it attempted to invoke. cifs_resize_file_locked() requires i_rwsem, but the truncate path from cifs_open() executes without that lock, breaking the invariant needed for a coherent fscache cookie resize.

Attack Vector

Exploitation requires local access and low privileges on a system that mounts a CIFS share with fscache enabled. An attacker with permission to open files with O_TRUNC on the share can induce cache incoherency, causing subsequent readers to observe outdated cached content instead of the current file state.

No verified public proof-of-concept code is available. Refer to the upstream commits 364b183, 81fc386, and 8b9b10f for the exact source-level changes.

Detection Methods for CVE-2026-89639

Indicators of Compromise

Unexpected divergence between file contents returned from CIFS mounts and the authoritative content on the SMB server following O_TRUNC operations.
Applications reading stale data from files that were recently truncated on CIFS shares configured with fscache.
Kernel log entries related to cifs, fscache, or cookie state transitions correlated with truncate operations.

Detection Strategies

Inventory Linux hosts running kernel versions that predate the fix commits and mount CIFS/SMB shares with fsc (fscache) enabled.
Compare kernel package versions against distribution advisories that reference the upstream commits listed in the NVD entry.
Audit mount options on production systems using mount | grep cifs to identify shares configured with fscache.

Monitoring Recommendations

Monitor kernel package upgrade status through configuration management tooling to confirm patched builds are deployed.
Track process and file operations on CIFS mount points using auditd or eBPF-based telemetry to detect unusual truncate patterns.
Alert on discrepancies between server-side and client-side file sizes for critical files stored on CIFS shares.

How to Mitigate CVE-2026-89639

Immediate Actions Required

Apply the Linux kernel stable updates that include commits 364b183, 81fc386, and 8b9b10f.
Reboot affected systems after patching to ensure the fixed kernel is active.
Restrict local access on hosts that mount CIFS shares with fscache enabled until patches are applied.

Patch Information

The upstream fix modifies cifs_do_truncate() to call cifs_invalidate_cache() after cifs_setsize() instead of attempting cifs_resize_file_locked(). This ensures fscache_invalidate() runs without requiring i_rwsem, correctly marking cached data as invalid. Consult your distribution's security tracker for backported package versions that correspond to the referenced kernel commits.

Workarounds

Disable fscache on CIFS mounts by removing the fsc mount option in /etc/fstab and remounting affected shares.
Limit which local accounts can access CIFS-mounted directories where O_TRUNC operations occur.
Where feasible, unmount CIFS shares on hosts that cannot be promptly patched and rely on alternative file transfer methods until updates are applied.

bash

# Verify running kernel version and CIFS mount options
uname -r
mount -t cifs

# Example: remount a CIFS share without fscache as a temporary workaround
umount /mnt/share
mount -t cifs //server/share /mnt/share -o username=user,password=pass