CVE-2026-89639Medium· 5.5▾ Sunlit

kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (CVE-2026-89639)

A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When a file is truncated, the `cifs_do_truncate()` function does not properly invalidate the file system cache (fscache). This oversight can lead to …

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score30/ 100 · Low

impact 30.3 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 11, 2026

Updated

Sep 16, 2026

CVSS

5.5

Vendor

Red Hat

Product

Red Hat Enterprise Linux 10

CWE

CWE-524

Depth score

30 · Low

EPSS

0.12% · p3

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Scores by source

CNA 7.1 · Vendor 3.3⚖ 3.8-point dispute

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

0.2% → 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

15 events · 6 days

Sep 11, 2026Published
Disclosed via CSAF
Sep 12, 2026EPSS first tracked
0.2%
Sep 13, 2026CVSS changed
— → 3.3
Sep 13, 2026Severity changed
none → low
Sep 13, 2026CVSS changed
— → 7.1
Sep 13, 2026Severity changed
none → high
Sep 14, 2026CVSS changed
7.1 → 3.3
Sep 14, 2026Severity changed
high → low
Sep 14, 2026CVSS changed
3.3 → 7.1
Sep 14, 2026Severity changed
low → high
Sep 14, 2026CVSS changed
7.1 → 3.3
Sep 14, 2026Severity changed
high → low
Sep 16, 2026Record revised
Last analysed / modified upstream
Sep 16, 2026CVSS changed
3.3 → 5.5
Sep 16, 2026Severity changed
low → medium

Red Hat CWE-524 #csaf #vex #red-hat #cve.org #score-dispute

Affected

enterprise_linux 10

Full technical detail▾

Overview

A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When a file is truncated, the cifs_do_truncate() function does not properly invalidate the file system cache (fscache). This oversight can lead to stale cached data being served to users, potentially resulting in information disclosure or data inconsistency.

Vendor advisories

Red Hat VEX · Moderate · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-16 · vex

kernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-16.

Affected:

Red Hat Enterprise Linux 10

No fix planned:

Red Hat Enterprise Linux 10

Not affected:

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift Container Platform 4

Remediation

Fix deferred

References

Change history

Field changes observed since this record was first indexed.

Sep 16, 2026CVSS 3.3 → 5.5
Sep 16, 2026Severity low → medium
Sep 14, 2026CVSS 7.1 → 3.3
Sep 14, 2026Severity high → low
Sep 14, 2026CVSS 3.3 → 7.1
Sep 14, 2026Severity low → high
Sep 14, 2026CVSS 7.1 → 3.3
Sep 14, 2026Severity high → low
Sep 13, 2026CVSS — → 7.1
Sep 13, 2026Severity none → high
Sep 13, 2026CVSS — → 3.3
Sep 13, 2026Severity none → low

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#cve.org#score-dispute

← Back to feed