CVE-2026-89639: In the Linux kernel, the following vulnerability has been resolved: cifs: use cifs_invalidate_cache() in cifs_do_trunca
Summary
A vulnerability in the Linux kernel's CIFS (Common Internet File System, a protocol for sharing files over networks) module was fixed by changing how file truncation handles cached data. The fix adds a call to cifs_invalidate_cache() after truncating a file, which clears stale cached data (data stored in memory for quick access) without requiring a lock that was unavailable during the truncation operation.
Solution / Mitigation
Add cifs_invalidate_cache() after cifs_setsize() in the cifs_do_truncate() function. This function calls fscache_invalidate() to increment the invalidation counter and set the FSCACHE_COOKIE_NO_DATA_TO_READ flag, ensuring stale cached data is not used when the cache is reactivated.
Vulnerability Details
EPSS: 0.0%
September 11, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-89639
First tracked: September 11, 2026 at 08:07 PM
Classified by LLM (prompt v3) · confidence: 95%