CVE-2026-89642

In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache_isize_extended() in cifs_setsize() when extending cifs_setsize() calls truncate_pagecache() but skips pagecache_isize_extended() on extension. truncate_setsize() shows the correct pattern: i_size_write(inode, newsize); if (newsize > oldsize) pagecache_isize_extended(inode, oldsize, newsize); truncate_pagecache(inode, newsize); pagecache_isize_extended() zeroes the tail of the page straddling old EOF. Without it, dirty bytes in that region can be written back to the server, exposing stale data in the newly extended range.

EPSS

0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-25)

Published

2026-09-11

Modified

2026-10-21

Record from

the NVD, synced 2026-10-22

References

• https://git.kernel.org/stable/c/12bafe32f09c0d24f5096154b59c347b9c6606e0
• https://git.kernel.org/stable/c/40c16040783abcc240bd1b453e679ea6ca30e19e
• https://git.kernel.org/stable/c/5463d96cd2e46064ceefcf861b028745a4f4c373
• https://git.kernel.org/stable/c/c510edb9734af1c274d18f4f31a471a166bbc7e8
• https://git.kernel.org/stable/c/e1f692b6da3e632a25d0b3a99f833bb609bae1a3

Check your stackJSON