CVE-2026-89639
Description
A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When a file is truncated, the cifs_do_truncate() function does not properly invalidate the file system cache (fscache). This oversight can lead to stale cached data being served to users, potentially resulting in information disclosure or data inconsistency.
Statement
A moderate severity flaw was found in the Linux kernel CIFS client, affecting Red Hat Enterprise Linux 10, OpenShift Container Platform 5 (RHCOS 9), and Red Hat In-Vehicle OS 2. When a file on a CIFS-mounted share is opened with the O_TRUNC flag, cifs_do_truncate() is invoked from cifs_open() without holding i_rwsem, so it cannot perform a proper fscache cookie resize and the local file system cache (fscache) is not invalidated after the truncation. Stale cached data can therefore be served for the truncated file once the cookie is later activated, which can result in disclosure of previously cached file contents or data inconsistency. Exploitation requires a local user with write access to a file on a CIFS mount.
Red Hat Enterprise Linux 6, 7, 8, and 9, the Red Hat Enterprise Linux 10.0 and 10.2 update streams, and OpenShift Container Platform 4 releases are not affected because the vulnerable code is not present in their kernels.
The affected Red Hat product streams are currently marked as deferred: because this cache-coherence defect is rated Moderate severity, the fix is planned to be delivered in a future scheduled maintenance update rather than an immediate erratum. The residual risk until the fix is applied is that stale cached data may continue to be served for CIFS files truncated with O_TRUNC.
Red Hat rates this flaw as Moderate severity with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record assigns 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The difference reflects the impact dimensions assessed: Red Hat's score captures the availability impact of serving stale cached data to a local user who already has access to the affected file, whereas the upstream score weights the confidentiality and integrity impact of the stale data exposure.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.1 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
