CVE-2026-99111: Linux

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and O_TRUNC cifs_do_truncate() flushes dirty pages with filemap_write_and_wait() and truncates the file on the server, but in the old code both operations ran without holding i_rwsem or invalidate_lock. A concurrent buffered write via netfs_perform_write() -- which only needs i_rwsem shared -- could dirty new pages after the flush but before the local truncation, and those pages would be silently discarded by cifs_setsize() -> truncate_pagecache(). Fix by acquiring inode_lock (exclusive i_rwsem) and filemap_invalidate_lock at the top of cifs_do_truncate(), so the entire flush-truncate-resize sequence is atomic with respect to: - buffered writes (blocked by exclusive i_rwsem, since netfs_start_io_write takes i_rwsem shared), - read page faults (blocked by exclusive invalidate_lock, since filemap_fault takes it shared), - writeback collection (blocked by netfs_wb_begin/netfs_wb_end around the server truncate and local resize, since netfs_writepages also acquires the wb lock).

Засегнати продукти

• Linux Linux: 110fee6b9bb58a5c50047fc2594d415f741b591e преди 4d143608a0445443a85c9b29f4c9f8e63d5dbfc9; 110fee6b9bb58a5c50047fc2594d415f741b591e преди ffa66fdc7d35b890606767c4d2c7ac26b4d90a99; 110fee6b9bb58a5c50047fc2594d415f741b591e преди a8603b52b39f520ea8a34def74c23fba87396d3e
• Linux Linux: 6.18; преди 6.18; 6.18.59 до 6.18.*; 7.2.13 до 7.2.*; 7.3 до *

История

Други уязвимости в Linux Linux

• 8.1CVE-2026-99270
• 7.8CVE-2026-99269
• CVE-2026-99268
• CVE-2026-99266
• CVE-2026-99267

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-99111
• https://nvd.nist.gov/vuln/detail/CVE-2026-99111
• https://git.kernel.org/stable/c/4d143608a0445443a85c9b29f4c9f8e63d5dbfc9
• https://git.kernel.org/stable/c/ffa66fdc7d35b890606767c4d2c7ac26b4d90a99
• https://git.kernel.org/stable/c/a8603b52b39f520ea8a34def74c23fba87396d3e