Use of cache containing sensitive information in Linux kernel - CVE-2026-89639
Published: September 12, 2026
Vulnerability identifier: #VU149168
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-89639
CWE-ID: CWE-524
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose stale cached data.
The vulnerability exists due to improper cache invalidation in cifs_do_truncate() in the SMB client when truncating a file with O_TRUNC. A local user can trigger file truncation to disclose stale cached data.
The stale data can be served after the cache cookie is activated.
Affected software
Linux kernel
How to mitigate CVE-2026-89639
Install security update from vendor's repository.