CVE-2026-89641: Linux Kernel CIFS Use-After-Free Vulnerability

CVE-2026-89641 Overview

CVE-2026-89641 is a use-after-free vulnerability in the Linux kernel's Common Internet File System (CIFS) client. The flaw resides in cifs_file_set_size(), where the function borrows a tcon (tree connection) and server pointer from a writable file handle's tlink, then releases the handle via cifsFileInfo_put(). When the handle-based set_file_size() RPC fails, execution falls through to a path-based fallback that reuses the freed tcon pointer. A local attacker who triggers this path during session reconnection or teardown can exploit the dangling reference for memory corruption.

Critical Impact
Local privilege escalation and kernel memory corruption through a use-after-free in the CIFS client, exploitable when tlink references are dropped during reconnection.

Affected Products

Linux kernel (mainline, prior to fix commit 4bea15d9c768)
Linux kernel stable branches with the vulnerable cifs_file_set_size() code path
Distributions shipping kernels with CIFS client support enabled

Discovery Timeline

2026-09-11 - CVE-2026-89641 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89641

Vulnerability Analysis

The vulnerability lives in the else branch of cifs_file_set_size() in the CIFS client. The function calls find_writable_file() to obtain an open file handle, then borrows its tcon and server pointers from the associated tlink. After attempting the handle-based set_file_size() RPC, it releases the handle with cifsFileInfo_put().

When the handle-based operation fails, the code falls through to a path-based fallback guarded by if (tcon == NULL). Because tcon still holds its borrowed value, the guard is skipped and the function reuses the borrowed pointer for set_path_size(). The bug is a classic reuse-after-release pattern in kernel memory management.

Root Cause

The root cause is a lifetime mismatch between the borrowed tcon pointer and the underlying tlink reference. If cifsFileInfo_put() drops the last reference on a tlink that was already removed from the tlink tree — signaled by TCON_LINK_IN_TREE being cleared during reconnection or session teardown — then cifs_put_tlink() frees the associated tcon. The subsequent set_path_size() call operates on freed memory, producing a use-after-free condition.

Attack Vector

Exploitation requires local access with permissions to trigger file operations on a mounted CIFS share. An attacker races a truncate or size-setting operation against a CIFS session reconnection or teardown. When the handle-based RPC fails and the tlink reference count reaches zero at release time, the freed tcon structure is dereferenced by the fallback path. Successful exploitation can lead to kernel memory corruption and privilege escalation.

The vulnerability is described in prose only; refer to the upstream kernel commits for the precise code changes. See the kernel git commit for the fix.

Detection Methods for CVE-2026-89641

Indicators of Compromise

Kernel oops or panic messages referencing cifs_file_set_size, set_path_size, or cifs_put_tlink in dmesg or journalctl output
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the CIFS module during truncate operations
Unexpected CIFS session reconnections coinciding with file-size operations on mounted shares

Detection Strategies

Monitor kernel logs for CIFS-related stack traces that include find_writable_file and cifsFileInfo_put in the call chain
Enable KASAN on test and pre-production kernels to surface the use-after-free during CIFS stress testing
Audit installed kernel versions against distribution security advisories for the CIFS patch

Monitoring Recommendations

Track kernel package versions across the fleet and alert on hosts running unpatched CIFS-enabled kernels
Log all mount operations targeting SMB and CIFS shares and correlate with kernel error events
Watch for repeated CIFS reconnection events in system telemetry, which increase the window for triggering the race

How to Mitigate CVE-2026-89641

Immediate Actions Required

Apply the upstream kernel patch that sets tcon = NULL after cifsFileInfo_put() in cifs_file_set_size()
Update to a distribution kernel that includes commit 4bea15d9c7683218f57b8c1f5f0aa75cab76af8d or the equivalent stable backport
Reboot affected systems after patching to ensure the vulnerable kernel image is unloaded

Patch Information

The fix clears tcon after cifsFileInfo_put() so the existing if (tcon == NULL) guard takes the cifs_sb_tlink() path, which acquires a fresh reference for the path-based operation or fails cleanly if the session is gone. Relevant commits are available at the mainline commit, stable backport 1, and stable backport 2.

Workarounds

Unmount CIFS shares on systems where patching cannot be completed immediately
Restrict local user access on hosts that mount SMB and CIFS shares to reduce the exploitable attack surface
Blacklist the cifs kernel module on systems that do not require SMB client functionality using modprobe configuration

bash

# Blacklist the CIFS module on systems that do not require SMB client support
echo "blacklist cifs" | sudo tee /etc/modprobe.d/disable-cifs.conf
sudo update-initramfs -u
# Verify current kernel version and confirm the patch is applied after reboot
uname -r