CVE-2026-89642: Linux Kernel Information Disclosure Vulnerability

CVE-2026-89642 Overview

CVE-2026-89642 is an information disclosure vulnerability in the Linux kernel's CIFS (Common Internet File System) client. The flaw exists in cifs_setsize(), which extends a file's size but omits the required call to pagecache_isize_extended(). Without that call, the tail of the page straddling the old end-of-file (EOF) is not zeroed. Dirty bytes in that region can subsequently be written back to the SMB server, exposing stale in-memory data in the newly extended file range.

Critical Impact
A local process performing a file extension over a CIFS mount can cause stale kernel page cache data to be written to a remote SMB server, resulting in unintended information disclosure.

Affected Products

Linux kernel CIFS client (fs/cifs)
Distributions shipping affected stable kernel branches prior to the fix commits
SMB/CIFS mounts writing to remote file servers

Discovery Timeline

2026-09-11 - CVE-2026-89642 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89642

Vulnerability Analysis

The CIFS client's cifs_setsize() function updates the inode size and calls truncate_pagecache() for every size change. This is correct behavior when shrinking a file, but incomplete when extending one. The generic VFS helper truncate_setsize() demonstrates the correct pattern: after updating i_size, it invokes pagecache_isize_extended() whenever the new size exceeds the old size, and only then calls truncate_pagecache().

pagecache_isize_extended() zeroes the portion of the page cache page that straddles the old EOF. When this step is skipped, any residual bytes previously present in that partial page remain in memory. If the page is marked dirty and later written back to the server, those residual bytes are transmitted as legitimate file content within the newly extended range.

Root Cause

The root cause is a missing helper call in the file extension code path. cifs_setsize() implemented only a subset of the truncate_setsize() sequence, treating extension and truncation identically. The absence of the pagecache_isize_extended() call breaks the invariant that bytes past the old EOF must be zeroed before becoming part of the file.

Attack Vector

Exploitation requires local access to a system with a mounted CIFS share and the ability to extend files on that share (for example, via truncate(), ftruncate(), or a write past EOF). The attacker or unprivileged process triggers extension of a file whose old EOF falls in the middle of a page. Subsequent writeback flushes uninitialized page cache bytes to the SMB server, where they can be read back as file content. The disclosed data originates from kernel page cache memory and may contain fragments from unrelated files or workloads.

No exploitation code is required beyond standard file-extension system calls. See the upstream fixes for the exact code path: Kernel Git Commit 12bafe3 and Kernel Git Commit c510edb9.

Detection Methods for CVE-2026-89642

Indicators of Compromise

Unexpected non-zero byte patterns appearing in file ranges immediately following a file extension operation on CIFS mounts.
SMB write operations from clients running unpatched kernels immediately after truncate() or ftruncate() calls that extend file size.
File integrity monitors reporting non-deterministic content in newly allocated regions of files stored on SMB shares.

Detection Strategies

Inventory Linux hosts by kernel version and identify systems running CIFS client code prior to the fix commits 12bafe3 and c510edb9.
Correlate mount.cifs usage with kernel version telemetry to prioritize endpoints that actively use SMB mounts.
Review SMB server access logs for write patterns that follow file-size extension operations from Linux clients.

Monitoring Recommendations

Enable audit rules on truncate and ftruncate syscalls targeting paths under CIFS mount points.
Monitor kernel package inventory and flag hosts that have not received vendor updates addressing the CIFS subsystem.
Track SMB traffic volume and content anomalies on file shares accessed by Linux clients.

How to Mitigate CVE-2026-89642

Immediate Actions Required

Apply the vendor-supplied kernel update that backports the fix commits 12bafe3 and c510edb9 as soon as it is available for your distribution.
Identify all hosts using CIFS mounts and prioritize them in the patching queue.
Where feasible, avoid workloads that extend files on CIFS shares until patched kernels are deployed.

Patch Information

The upstream fix updates cifs_setsize() to call pagecache_isize_extended() when the new size exceeds the old size, mirroring the pattern used by truncate_setsize(). The patches are available at Kernel Git Commit 12bafe3 and Kernel Git Commit c510edb9. Distribution vendors are expected to backport these commits into supported stable kernel branches.

Workarounds

Mount CIFS shares as read-only where write access is not required, preventing the vulnerable code path from executing.
Restrict CIFS mount usage to trusted workloads that do not extend files past existing EOF boundaries.
Migrate affected workloads to alternative protocols such as NFS on hosts where a patched kernel is not yet available.

bash

# Configuration example: mount a CIFS share read-only as a temporary workaround
mount -t cifs //server/share /mnt/share -o ro,vers=3.0,username=user