CVE-2026-89642: cifs: call pagecache_isize_extended() in cifs_setsize() when extending
In the Linux kernel, the following vulnerability has been resolved:
cifs: call pagecacheisizeextended() in cifssetsize() when extending
cifssetsize() calls truncatepagecache() but skips pagecacheisizeextended() on extension. truncatesetsize() shows the correct pattern:
isizewrite(inode, newsize); if (newsize > oldsize) pagecacheisizeextended(inode, oldsize, newsize); truncatepagecache(inode, newsize);
pagecacheisizeextended() zeroes the tail of the page straddling old EOF. Without it, dirty bytes in that region can be written back to the server, exposing stale data in the newly extended range.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to stale-data disclosure from this issue?
Systems using the Linux kernel CIFS client are exposed when a file is extended through the affected CIFS size-setting path. The risk arises if the page containing the previous end of file has dirty bytes beyond that old EOF.
What must happen for stale data to be exposed?
A CIFS file must be extended, leaving a page that straddles the former EOF. Because the tail of that page is not zeroed, dirty data already present there can be written back to the server and become visible in the newly extended file range.
How can administrators determine whether the fix is present?
Check whether the kernel's CIFS cifs_setsize() implementation calls pagecache_isize_extended() when newsize is greater than oldsize, before truncate_pagecache(). The referenced stable commits contain the correction.