CVE-2026-99137 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
cifs: don't update i_size in cifs_do_truncate without a cached handle
If find_writable_file() returns null, cifs_file_flush will return 0 without issuing set_file_size, and the outer 'if (!rc)' block will set i_size to 0 before telling the server to truncate. If the cifs_open() then fails, the inode will have size 0, while the server file is unchanged.
Move the netfs_resize_file() and cifs_setsize() into the 'if (cfile)', so they only run after a successful set_file_size.
In the no-handle else branch, evict stale pages with truncate_inode_pages before the O_TRUNC open to dispose of old cache pages, and let the open response set the i_size.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in the Common Vulnerabilities and Exposures (CVE) database pertains to a logic error within the Client Side InterFile System (CIFS) implementation in the Linux kernel, specifically affecting how file size attributes are synchronized between local inode structures and remote server state during truncation operations. This issue arises from an incorrect handling of cached handles when attempting to modify file sizes via the cifs_do_truncate function. The core technical flaw lies in the conditional logic that governs whether the local inode's i_size attribute is updated before or after communication with the SMB/CIFS server occurs. When find_writable_file returns null, indicating no valid writable handle exists for the target file, the code path incorrectly proceeds to set the local inode size to zero without first ensuring that the remote file has been successfully truncated on the server side. This creates a state inconsistency where the local kernel representation of the file appears empty while the actual data remains intact on the storage backend.
This desynchronization poses significant risks for applications relying on accurate file metadata, particularly those performing sequential reads or writes after truncation operations. If an application opens a file with the O_TRUNC flag expecting it to be emptied locally and remotely, but the open operation fails due to permission issues, locking conflicts, or other transient errors, the inode retains its zeroed size while the server still holds the original data. Subsequent read attempts may return empty results based on the local i_size, leading to silent data loss from the perspective of the application layer. This behavior violates fundamental expectations regarding atomicity and consistency in file system operations, potentially causing corruption in databases or configuration files that depend on precise size tracking during resize events.
From a classification standpoint, this vulnerability aligns with CWE-665, which describes improper initialization, as well as CWE-362, involving concurrent execution risks where race conditions between local state updates and remote server responses lead to inconsistent states. The ATT&CK framework does not directly map kernel-level logic errors like this to specific attack techniques unless exploited for privilege escalation or denial of service, but the underlying mechanism resembles improper input validation in system calls that could be leveraged by malicious actors to cause resource exhaustion or data inconsistency attacks within containerized environments or shared storage scenarios.
To mitigate this vulnerability, it is critical to ensure that local inode metadata updates are strictly coupled with successful remote server operations. The fix involves restructuring the code flow so that netfs_resize_file and cifs_setsize functions are executed only after a valid file handle has been obtained and set_file_size succeeds on the server side. Additionally, in scenarios where no writable handle is available, stale cache pages should be evicted using truncate_inode_pages prior to attempting an O_TRUNC open operation. This ensures that any outdated cached data is discarded before new access patterns are established, allowing the subsequent open response to correctly populate the i_size attribute based on actual server state rather than assuming truncation success prematurely. System administrators and developers must apply kernel patches promptly to restore consistency guarantees in CIFS-mounted filesystems, especially those used for critical workloads requiring high reliability and data integrity across networked storage infrastructures.