All vulnerabilities
CVE-2026-99137

Linux: cifs: don't update i_size in cifs_do_truncate without a cached handle

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in04d020b3d0b58a1b7e116900e4095b96a7f4e11aAlso 88a51743cd8094b76fd910f53f718747c7729cc8CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 04d020b3d0b58a1b7e116900e4095b96a7f4e11aLinuxCVE List
  • 88a51743cd8094b76fd910f53f718747c7729cc8LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: don't update i_size in cifs_do_truncate without a cached handle

If find_writable_file() returns null, cifs_file_flush will return 0 without issuing set_file_size, and the outer 'if (!rc)' block will set i_size to 0 before telling the server to truncate. If the cifs_open() then fails, the inode will have size 0, while the server file is unchanged.

Move the netfs_resize_file() and cifs_setsize() into the 'if (cfile)', so they only run after a successful set_file_size.

In the no-handle else branch, evict stale pages with truncate_inode_pages before the O_TRUNC open to dispose of old cache pages, and let the open response set the i_size.

Text from CVE List

Affected versions 8

  • Linuxaffected: 110fee6b9bb58a5c50047fc2594d415f741b591e before 04d020b3d0b58a1b7e116900e4095b96a7f4e11aCVE List
  • Linuxaffected: 110fee6b9bb58a5c50047fc2594d415f741b591e before 88a51743cd8094b76fd910f53f718747c7729cc8CVE List
  • Linuxaffected: 110fee6b9bb58a5c50047fc2594d415f741b591e before fe39cd9d48f2346605f3746e0cc19e89d5f373ebCVE List
  • Linuxaffected: 6.18CVE List
  • Linuxunaffected: all versions before 6.18CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3