CVE-2026-89639

In the Linux kernel, the following vulnerability has been resolved:

cifs: use cifs invalidate cache() in cifs do truncate() for O TRUNC

cifs do truncate() is invoked from cifs open() without i rwsem, so it cannot use cifs resize file locked() to perform a proper fscache cookie resize. Instead, add cifs invalidate cache() after cifs setsize().

cifs invalidate cache() calls fscache invalidate(), which works without holding i rwsem: it unconditionally increments inval counter and sets FSCACHE COOKIE NO DATA TO READ, ensuring that stale cached data is not served once the cookie is later activated by fscache use cookie(). Truncation to zero leaves no valid cached data, making invalidation the correct semantic here.