Skip to main content
← All vulnerabilities
CVE-2026-99111EUVD-2026-112011

smb: client: fix data corruption with concurrent writes and O_TRUNC

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub

Summary

The Linux kernel's SMB client (CIFS) file truncation path can lose data when a file is opened with O_TRUNC while another process is writing to it concurrently. The impact is silent data corruption, where recently written data can be discarded from the page cache and never reach the server.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and O_TRUNC cifs_do_truncate() flushes dirty pages with filemap_write_and_wait() and truncates the file on the server, but in the old code both operations ran without holding i_rwsem or invalidate_lock. A concurrent buffered write via netfs_perform_write() -- which only needs i_rwsem shared -- could dirty new pages after the flush but before the local truncation, and those pages would be silently discarded by cifs_setsize() -> truncate_pagecache(). Fix by acquiring inode_lock (exclusive i_rwsem) and filemap_invalidate_lock at the top of cifs_do_truncate(), so the entire flush-truncate-resize sequence is atomic with respect to: • buffered writes (blocked by exclusive i_rwsem, since netfs_start_io_write takes i_rwsem shared), • read page faults (blocked by exclusive invalidate_lock, since filemap_fault takes it shared), • writeback collection (blocked by netfs_wb_begin/netfs_wb_end around the server truncate and local resize, since netfs_writepages also acquires the wb lock).

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • Linux Linux

    Version range not reported

  • Linux Linux

    6.18

References 3

git.kernel.org