CVE-2026-99111 smb: client: fix data corruption with concurrent writes and O_TRUNC
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99111?
CVE-2026-99111 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix data corruption with concurrent writes and O_TRUNC
cifs_do_truncate() flushes dirty pages with filemap_write_and_wait() and truncates the file on the server, but in the old code both operations ran without holding i_rwsem or invalidate_lock. A concurrent buffered write via netfs_perform_write() -- which only needs i_rwsem shared -- could dirty new pages after the flush but before the local truncation, and those pages would be silently discarded by cifs_setsize() -> truncate_pagecache().
Fix by acquiring inode_lock (exclusive i_rwsem) and filemap_invalidate_lock at the top of cifs_do_truncate(), so the entire flush-truncate-resize sequence is atomic with respect to:
- buffered writes (blocked by exclusive i_rwsem, since netfs_start_io_write takes i_rwsem shared), - read page faults (blocked by exclusive invalidate_lock, since filemap_fault takes it shared), - writeback collection (blocked by netfs_wb_begin/netfs_wb_end around the server truncate and local resize, since netfs_writepages also acquires the wb lock).
Which versions are affected by CVE-2026-99111?
How do I fix CVE-2026-99111?
Upgrade to a fixed version.
Is CVE-2026-99111 being exploited?
There is no known exploitation of CVE-2026-99111 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-99111, DEBIAN-CVE-2026-99111, GHSA-2cjv-j4m8-25m8, UBUNTU-CVE-2026-99111.