CVE-2026-99111 - Vulnerability Details

- smb: client: fix data corruption with concurrent writes and O_TRUNC

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix data corruption with concurrent writes and O_TRUNC

cifs_do_truncate() flushes dirty pages with filemap_write_and_wait()
and truncates the file on the server, but in the old code both
operations ran without holding i_rwsem or invalidate_lock. A
concurrent buffered write via netfs_perform_write() -- which only
needs i_rwsem shared -- could dirty new pages after the flush but
before the local truncation, and those pages would be silently
discarded by cifs_setsize() -> truncate_pagecache().

Fix by acquiring inode_lock (exclusive i_rwsem) and
filemap_invalidate_lock at the top of cifs_do_truncate(), so the
entire flush-truncate-resize sequence is atomic with respect to:

- buffered writes (blocked by exclusive i_rwsem, since
netfs_start_io_write takes i_rwsem shared),
- read page faults (blocked by exclusive invalidate_lock, since
filemap_fault takes it shared),
- writeback collection (blocked by netfs_wb_begin/netfs_wb_end
around the server truncate and local resize, since
netfs_writepages also acquires the wb lock).

Published: 2026-10-28

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel SMB client contained a race condition in the `cifs_do_truncate` function, allowing concurrent writes to corrupt the local pagecache after a server‑side truncate. This defect could cause loss or corruption of file data, impacting the reliability and integrity of file system contents.

Affected Systems

All Linux kernel releases that include the SMB/CIFS client before the patch were affected; the Affected Vendor list is Linux:Linux and no specific version range is given in the CNA data.

Risk and Exploitability

The CVSS score is not provided and the EPSS score is unavailable, but the vulnerability is not listed in CISA’s KEV catalog. Exploitation would require the ability to trigger simultaneous buffered writes and truncation on a file accessed via SMB, which can be performed by any user with write access to a shared file. No privilege escalation or remote code execution results are known; the primary consequence is integrity loss of the targeted file.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`110fee6b9bb58a5c50047fc2594d415f741b591e`	affected	< 4d143608a0445443a85c9b29f4c9f8e63d5dbfc9
`110fee6b9bb58a5c50047fc2594d415f741b591e`	affected	< ffa66fdc7d35b890606767c4d2c7ac26b4d90a99
`110fee6b9bb58a5c50047fc2594d415f741b591e`	affected	< a8603b52b39f520ea8a34def74c23fba87396d3e

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.59`	unaffected	≤ 6.18.*
`7.2.13`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[110fee6b9bb58a5c50047fc2594d415f741b591e,4d143608a0445443a85c9b29f4c9f8e63d5dbfc9)`	affected	code_commit	—
`[110fee6b9bb58a5c50047fc2594d415f741b591e,ffa66fdc7d35b890606767c4d2c7ac26b4d90a99)`	affected	code_commit	—
`[110fee6b9bb58a5c50047fc2594d415f741b591e,a8603b52b39f520ea8a34def74c23fba87396d3e)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	generic	—
`[6.18.59,6.19.0)`	unaffected	semver	—
`[7.2.13,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[110fee6b9bb58a5c50047fc2594d415f741b591e,4d143608a0445443a85c9b29f4c9f8e63d5dbfc9)`	affected	code_commit	—
`[110fee6b9bb58a5c50047fc2594d415f741b591e,ffa66fdc7d35b890606767c4d2c7ac26b4d90a99)`	affected	code_commit	—
`[110fee6b9bb58a5c50047fc2594d415f741b591e,a8603b52b39f520ea8a34def74c23fba87396d3e)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	generic	—
`[6.18.59,6.19.0)`	unaffected	semver	—
`[7.2.13,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version that incorporates the CIFS race condition fix.
Reboot the system to load the updated kernel module.
Until the kernel update is available, restrict or disable operations that write to SMB shares from users to prevent concurrent truncation and writes.

Generated by OpenCVE AI on October 28, 2026 at 12:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4d143608a0445443a85c9b29f4c9f8e63d5dbfc9
https://git.kernel.org/stable/c/a8603b52b39f520ea8a34def74c23fba87396d3e
https://git.kernel.org/stable/c/ffa66fdc7d35b890606767c4d2c7ac26b4d90a99

History

Wed, 28 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Wed, 28 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Wed, 28 Oct 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and O_TRUNC cifs_do_truncate() flushes dirty pages with filemap_write_and_wait() and truncates the file on the server, but in the old code both operations ran without holding i_rwsem or invalidate_lock. A concurrent buffered write via netfs_perform_write() -- which only needs i_rwsem shared -- could dirty new pages after the flush but before the local truncation, and those pages would be silently discarded by cifs_setsize() -> truncate_pagecache(). Fix by acquiring inode_lock (exclusive i_rwsem) and filemap_invalidate_lock at the top of cifs_do_truncate(), so the entire flush-truncate-resize sequence is atomic with respect to: - buffered writes (blocked by exclusive i_rwsem, since netfs_start_io_write takes i_rwsem shared), - read page faults (blocked by exclusive invalidate_lock, since filemap_fault takes it shared), - writeback collection (blocked by netfs_wb_begin/netfs_wb_end around the server truncate and local resize, since netfs_writepages also acquires the wb lock).
Title		smb: client: fix data corruption with concurrent writes and O_TRUNC
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4d143608a0445443a85c9b29f4c9f8e63d5dbfc9 https://git.kernel.org/stable/c/a8603b52b39f520ea8a34def74c23fba87396d3e https://git.kernel.org/stable/c/ffa66fdc7d35b890606767c4d2c7ac26b4d90a99

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-28T10:34:29.053Z

Updated: 2026-10-28T10:34:29.053Z

Reserved: 2026-09-25T10:25:14.392Z

Link: CVE-2026-99111

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-28T11:17:30.520

Modified: 2026-10-28T11:17:30.520

Link: CVE-2026-99111

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-28T13:30:20Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object