PT-2026-128104
CVE-2026-99111
·
Published
2026-10-28
·
Updated
2026-10-28
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix data corruption with concurrent writes and O TRUNC
cifs do truncate() flushes dirty pages with filemap write and wait()
and truncates the file on the server, but in the old code both
operations ran without holding i rwsem or invalidate lock. A
concurrent buffered write via netfs perform write() -- which only
needs i rwsem shared -- could dirty new pages after the flush but
before the local truncation, and those pages would be silently
discarded by cifs setsize() -> truncate pagecache().
Fix by acquiring inode lock (exclusive i rwsem) and
filemap invalidate lock at the top of cifs do truncate(), so the
entire flush-truncate-resize sequence is atomic with respect to:
- buffered writes (blocked by exclusive i rwsem, since netfs start io write takes i rwsem shared),
- read page faults (blocked by exclusive invalidate lock, since filemap fault takes it shared),
- writeback collection (blocked by netfs wb begin/netfs wb end around the server truncate and local resize, since netfs writepages also acquires the wb lock).
Found an issue in the description? Have something to add? Feel free to write us 👾