CVE-2026-89639: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
In the Linux kernel, the following vulnerability has been resolved:
cifs: use cifsinvalidatecache() in cifsdotruncate() for OTRUNC
cifsdotruncate() is invoked from cifsopen() without irwsem, so it cannot use cifsresizefilelocked() to perform a proper fscache cookie resize. Instead, add cifsinvalidatecache() after cifssetsize().
cifsinvalidatecache() calls fscacheinvalidate(), which works without holding irwsem: it unconditionally increments invalcounter and sets FSCACHECOOKIENODATATOREAD, ensuring that stale cached data is not served once the cookie is later activated by fscacheusecookie(). Truncation to zero leaves no valid cached data, making invalidation the correct semantic here.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed for this issue to matter?
The affected path involves CIFS file opens using O_TRUNC, which truncates a file to zero length. The stale-data condition is relevant when FS-Cache is used with CIFS, because the fix invalidates the associated FS-Cache cookie after the size change.
What is the practical impact before the fix?
After an O_TRUNC operation, stale cached data may remain associated with the CIFS file and could be served when the FS-Cache cookie is later activated. The fix ensures the cache is invalidated so no pre-truncation data is read from that cookie.
What can be done if the kernel cannot be updated immediately?
Avoid relying on FS-Cache-backed CIFS access for files that may be opened with O_TRUNC. Disabling or avoiding the affected caching path prevents stale FS-Cache data from being served in this scenario.