Executive brief
The Linux kernel's CIFS (Common Internet File System) client has a bug in file size extension handling that can expose stale data. When a file is extended, the kernel fails to properly zero out the tail of the cached page at the old end-of-file, allowing dirty data from that region to be written back to the SMB/CIFS server, potentially leaking sensitive information that should have been blanked.
Technical details
The vulnerability is an information disclosure flaw in the CIFS client's cifs_setsize() function (fs/smb/client/inode.c). When extending a file size, the function calls truncate_pagecache() but omits the required pagecache_isize_extended() call that zeroes the tail of the page straddling the old EOF. This allows uninitialized or previously-written dirty bytes in that region to persist in the page cache and be written back to the SMB server. The fix adds a conditional call to pagecache_isize_extended(inode, old_size, offset) when offset > old_size, matching the pattern used correctly in truncate_setsize(). The issue affects the Linux kernel CIFS client and is corrected in recent stable kernels via upstream commit c510edb9.
Affected products
- Linux Linux kernel all versions prior to fix commit c510edb9734af1c274d18f4f31a471a166bbc7e8
Timeline
- 2026-09-11: disclosed: CVE-2026-89642 published
- 2026-08-24: patched: Fix committed upstream as c510edb9734af1c274d18f4f31a471a166bbc7e8
- 2026-09-07: other: Patch integrated into stable kernels