CVE-2026-89639

A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When a file is truncated, the cifs_do_truncate() function does not properly invalidate the file system cache (fscache). This oversight can lead to stale cached data being served to users, potentially resulting in information disclosure or data inconsistency.

A moderate severity flaw was found in the Linux kernel CIFS client, affecting Red Hat Enterprise Linux 10, OpenShift Container Platform 5 (RHCOS 9), and Red Hat In-Vehicle OS 2. When a file on a CIFS-mounted share is opened with the O_TRUNC flag, cifs_do_truncate() is invoked from cifs_open() without holding i_rwsem, so it cannot perform a proper fscache cookie resize and the local file system cache (fscache) is not invalidated after the truncation. Stale cached data can therefore be served for the truncated file once the cookie is later activated, which can result in disclosure of previously cached file contents or data inconsistency. Exploitation requires a local user with write access to a file on a CIFS mount.

Red Hat Enterprise Linux 6, 7, 8, and 9, the Red Hat Enterprise Linux 10.0 and 10.2 update streams, and OpenShift Container Platform 4 releases are not affected because the vulnerable code is not present in their kernels.

The affected Red Hat product streams are currently marked as deferred: because this cache-coherence defect is rated Moderate severity, the fix is planned to be delivered in a future scheduled maintenance update rather than an immediate erratum. The residual risk until the fix is applied is that stale cached data may continue to be served for CIFS files truncated with O_TRUNC.

Red Hat rates this flaw as Moderate severity with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), while the upstream CVE record assigns 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The difference reflects the impact dimensions assessed: Red Hat's score captures the availability impact of serving stale cached data to a local user who already has access to the affected file, whereas the upstream score weights the confidentiality and integrity impact of the stale data exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.