CVE-2026-89641

A flaw was found in the Linux kernel's Common Internet File System (CIFS) module. This vulnerability, a use-after-free, occurs in the cifs_file_set_size() function. When a file's size is being modified, a critical system resource (tcon object) can be released too early but then accessed again. A local attacker could exploit this to cause a system crash, leading to a Denial of Service (DoS), or potentially execute unauthorized code.

A use-after-free can occur in cifs_file_set_size() because tcon and server are borrowed from an open file tlink and then reused after cifsFileInfo_put() may drop the last reference. If the handle based set_file_size() RPC fails and the code falls back to set_path_size(), the stale tcon can be used after the tlink was removed during reconnect or session teardown. For the CVSS the PR:L is used because a local process with access to a mounted CIFS path is normally needed to trigger the size change, while a malicious or unstable SMB server can make the race more reachable but does not by itself provide a pure packet only trigger. The issue is not directly network reachable in the selected scoring, but it is network assisted in SMB/CIFS deployments. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel use-after-free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.