# CVE-2026-89639

## Summary

- **CVE ID:** CVE-2026-89639
- **Severity:** HIGH
- **CVSS Score:** 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 13, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC

cifs_do_truncate() is invoked from cifs_open() without i_rwsem, so it
cannot use cifs_resize_file_locked() to perform a proper fscache cookie
resize.  Instead, add cifs_invalidate_cache() after cifs_setsize().

cifs_invalidate_cache() calls fscache_invalidate(), which works without
holding i_rwsem: it unconditionally increments inval_counter and sets
FSCACHE_COOKIE_NO_DATA_TO_READ, ensuring that stale cached data is not
served once the cookie is later activated by fscache_use_cookie().
Truncation to zero leaves no valid cached data, making invalidation the
correct semantic here.

## Affected Products

- Linux — Linux (efbcecdecefc26fa062c0e8210533ccad7d6bd4a)
- Linux — Linux (fa724e235cfdb0fb0bb427d0f9dfe864ae27403e)
- Linux — Linux (6838bcac954487cc0a3c8a4ee1b3a3a30e244dc9)
- Linux — Linux (75640976cf474eb41682a13f2dbe9534ac26ca50)
- Linux — Linux (3513f3931c579ba2a715784c6dedc59e0d9282ee)
- Linux — Linux (6.18.44)
- Linux — Linux (6.12.105)
- Linux — Linux (7.1.8)
- Linux — Linux (7.2)
- Linux — Linux (0)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)

## References

- [CNA](https://git.kernel.org/stable/c/8b9b10fe5b8b492b27b9f4546742ea541a650213)
- [CNA](https://git.kernel.org/stable/c/81fc3868a7f726980ff845c1d0d271051e5f0f45)
- [CNA](https://git.kernel.org/stable/c/364b183230586a62660a7280c1eb20138338eeb5)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.12%
- **EPSS Percentile:** 2.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._