---
id: CVE-2026-99111
title: 'smb: client: fix data corruption with concurrent writes and O_TRUNC'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix data corruption with concurrent writes and O_TRUNC

  cifs_do_truncate() flushes dirty pages with filemap_write_and_wait()
  and truncates the file on the …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 110fee6b9bb58a5c50047fc2594d415f741b591e <
    4d143608a0445443a85c9b29f4c9f8e63d5dbfc9
  - >-
    Linux >= 110fee6b9bb58a5c50047fc2594d415f741b591e <
    ffa66fdc7d35b890606767c4d2c7ac26b4d90a99
  - >-
    Linux >= 110fee6b9bb58a5c50047fc2594d415f741b591e <
    a8603b52b39f520ea8a34def74c23fba87396d3e
  - Linux 6.18
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:34:29.053Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99111'
references:
  - url: 'https://git.kernel.org/stable/c/4d143608a0445443a85c9b29f4c9f8e63d5dbfc9'
  - url: 'https://git.kernel.org/stable/c/ffa66fdc7d35b890606767c4d2c7ac26b4d90a99'
  - url: 'https://git.kernel.org/stable/c/a8603b52b39f520ea8a34def74c23fba87396d3e'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.452Z'
epss: 0.00167
epssPercentile: 0.0596
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix data corruption with concurrent writes and O_TRUNC

cifs_do_truncate() flushes dirty pages with filemap_write_and_wait()
and truncates the file on the server, but in the old code both
operations ran without holding i_rwsem or invalidate_lock.  A
concurrent buffered write via netfs_perform_write() -- which only
needs i_rwsem shared -- could dirty new pages after the flush but
before the local truncation, and those pages would be silently
discarded by cifs_setsize() -> truncate_pagecache().

Fix by acquiring inode_lock (exclusive i_rwsem) and
filemap_invalidate_lock at the top of cifs_do_truncate(), so the
entire flush-truncate-resize sequence is atomic with respect to:

  - buffered writes (blocked by exclusive i_rwsem, since
    netfs_start_io_write takes i_rwsem shared),
  - read page faults (blocked by exclusive invalidate_lock, since
    filemap_fault takes it shared),
  - writeback collection (blocked by netfs_wb_begin/netfs_wb_end
    around the server truncate and local resize, since
    netfs_writepages also acquires the wb lock).

## Affected

- `Linux >= 110fee6b9bb58a5c50047fc2594d415f741b591e < 4d143608a0445443a85c9b29f4c9f8e63d5dbfc9`
- `Linux >= 110fee6b9bb58a5c50047fc2594d415f741b591e < ffa66fdc7d35b890606767c4d2c7ac26b4d90a99`
- `Linux >= 110fee6b9bb58a5c50047fc2594d415f741b591e < a8603b52b39f520ea8a34def74c23fba87396d3e`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.