CVE-2026-89641

In the Linux kernel, the following vulnerability has been resolved:

cifs: clear tcon after cifsFileInfo put() in cifs file set size()

When the else branch of cifs file set size() finds a writable file handle via find writable file(), it borrows tcon and server from the handle's tlink, attempts the handle-based set file size() RPC, and then releases the handle with cifsFileInfo put().

If set file size() fails, execution falls through to the path-based fallback, which reuses the borrowed tcon and server under the "if (tcon == NULL)" guard. Since tcon is not NULL at that point, the guard is skipped. If cifsFileInfo put() dropped the last reference on a tlink that was already removed from the tlink tree (TCON LINK IN TREE cleared, as happens during reconnection or session teardown), cifs put tlink() will have freed tcon; the subsequent set path size() call is then a use-after-free.

Setting tcon = NULL after cifsFileInfo put() causes the existing guard to take the cifs sb tlink() path, which acquires a fresh reference for the path-based operation or fails cleanly if the session is gone.