{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-89641", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-89641" ], "published": "2026-09-11T19:47:07Z", "summary": "cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()\n\nWhen the else branch of cifs_file_set_size() finds a writable file handle\nvia find_writable_file(), it borrows tcon and server from the handle's\ntlink, attempts the handle-based set_file_size() RPC, and then releases\nthe handle with cifsFileInfo_put().\n\nIf set_file_size() fails, execution falls through to the path-based\nfallback, which reuses the borrowed tcon and server under the\n\"if (tcon == NULL)\" guard. Since tcon is not NULL at that point, the\nguard is skipped. If cifsFileInfo_put() dropped the last reference on a\ntlink that was already removed from the tlink tree (TCON_LINK_IN_TREE\ncleared, as happens during reconnection or session teardown),\ncifs_put_tlink() will have freed tcon; the subsequent set_path_size()\ncall is then a use-after-free.\n\nSetting tcon = NULL after cifsFileInfo_put() causes the existing guard\nto take the cifs_sb_tlink() path, which acquires a fresh reference for\nthe path-based operation or fails cleanly if the session is gone.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.50" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.50" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.50" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.50" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89641" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/4f18c9e7ee464aaae5cd9fccdb943b3fcb4655d4" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/4bea15d9c7683218f57b8c1f5f0aa75cab76af8d" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/b96db32fed8dfb2478d7c208f89bf383beed1535" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-13T06:49:25Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The UAF is in the CIFS client setattr path (fs/smb/client/inode.c cifs_file_set_size), reached only via local VFS truncate/setattr on a mounted SMB share (sys_truncate \u2192 vfs_truncate \u2192 notify_change \u2192 cifs_setattr), not via ksmbd or unsolicited SMB receive processing.\nAC:L - A local attacker controls both sides: keep a writable handle open, issue truncate(2) to hit the find_writable_file() else branch, fail handle-based set_file_size (controlled/malicious server or reconnect), and concurrently umount/teardown so TCON_LINK_IN_TREE is already cleared when cifsFileInfo_put() drops the last tlink ref.\nPR:L - Any unprivileged user with write access on an existing CIFS mount can invoke truncate(2); vfs_truncate only requires MAY_WRITE and setattr_prepare does not demand CAP_SYS_ADMIN. CIFS is not FS_USERNS_MOUNT, but the vulnerable path itself needs no init-namespace capability.\nUI:N - The attacker performs open/truncate (and optional umount) themselves on a reachable CIFS mount such as an enterprise automount or a share they mounted; no separate victim action is required at exploit time.\nS:U - This is a standard in-kernel heap use-after-free of struct cifs_tcon on the client host, enabling privilege escalation within the same kernel security authority and not a VM, IOMMU, or sandbox escape.\nC:H - After cifsFileInfo_put() can free tcon, set_path_size()/smb2_compound_op() reads the freed cifs_tcon; kernel UAF of this heap object enables reuse/spraying and arbitrary kernel memory disclosure.\nI:H - The same freed tcon is passed into SMB2 compound operations that write tcon fields and follow tcon->ses pointers, so heap spraying yields arbitrary write and potential control-flow hijack primitives.\nA:H - Use-after-free of tcon in the path-based set_path_size fallback causes kernel oops/panic even without full exploitation, fully denying availability." } } }