CVE-2026-99137

In the Linux kernel, the following vulnerability has been resolved:

cifs: don't update i size in cifs do truncate without a cached handle

If find writable file() returns null, cifs file flush will return 0 without issuing set file size, and the outer 'if (!rc)' block will set i size to 0 before telling the server to truncate. If the cifs open() then fails, the inode will have size 0, while the server file is unchanged.

Move the netfs resize file() and cifs setsize() into the 'if (cfile)', so they only run after a successful set file size.

In the no-handle else branch, evict stale pages with truncate inode pages before the O TRUNC open to dispose of old cache pages, and let the open response set the i size.