CVE-2026-89642

A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When a client extends a file, the cifs_setsize() function fails to properly zero out the newly extended portion of the page cache. This oversight can lead to stale data from the client's memory being written back to the server, potentially exposing sensitive information to the server.

In the CIFS client, cifs_setsize did not call pagecache_isize_extended when a file was extended. The tail of the page crossing the old EOF could keep dirty stale bytes, and those bytes could later be written back to the SMB server as part of the newly extended file range. For the CVSS the PR:L is used because a local user or process must be able to operate on a CIFS mounted file and extend its size, but full administrative privileges are not normally required once the mount and file permissions allow writes. The issue is not a direct remote network attack against the client, but it can disclose local stale page cache data to a remote SMB server or to other readers of the extended file. Impact is confidentiality loss only, with no evidence of integrity loss, availability loss, memory corruption, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.