Is CVE-2026-99111 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-99111 being exploited in the wild.

How severe is CVE-2026-99111?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Linux kernel before fix commit a8603b52b39f520ea8a34def74c23fba87396d3e (affects all kernel versions shipping cifs_do_truncate).

Is there a fix for CVE-2026-99111?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-99111 attacked?

It is attacked over the network or with local access, in an operating system.

Am I affected by CVE-2026-99111?

Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-99111: Linux kernel SMB client data corruption with concurrent writes and O_TRUNC

CVE-2026-99111 · Severity: info · Published 2026-10-28

The Linux kernel's SMB client, used to mount and access Windows file shares and other SMB-based storage, had a race condition that could silently discard recently written data when truncating files. An attacker with write access to an SMB share could exploit concurrent write operations to cause data loss on files being truncated, potentially corrupting shared documents or logs on network storage.

Technologies: Linux kernel.

Quick answers

Is CVE-2026-99111 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-99111 being exploited in the wild.
How severe is CVE-2026-99111?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Linux kernel before fix commit a8603b52b39f520ea8a34def74c23fba87396d3e (affects all kernel versions shipping cifs_do_truncate).
Is there a fix for CVE-2026-99111?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-99111 attacked?: It is attacked over the network or with local access, in an operating system.
Am I affected by CVE-2026-99111?: Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The cifs_do_truncate() function performed file flush and truncation operations without holding necessary locks (inode_lock and invalidate_lock), creating a window where concurrent buffered writes could dirty new pages after flush but before truncation, causing data loss when truncate_pagecache() discarded those pages. The fix acquires exclusive i_rwsem and filemap_invalidate_lock atomically around the entire flush-truncate-resize sequence to prevent buffered writes, read faults, and writeback collection from racing with truncation.

Affected products

Linux kernel before fix commit a8603b52b39f520ea8a34def74c23fba87396d3e (affects all kernel versions shipping cifs_do_truncate)

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.