{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  smb: client: fix data corruption with concurrent writes and O_TRUNC  cifs_do_truncate() flushes dirty pages with filemap_write_and_wait() and truncates the file on the server, but in the old code both operations ran without holding i_rwsem or invalidate_lock.  A concurrent buffered write via netfs_perform_write() -- which only needs i_rwsem shared -- could dirty new pages after the flush but before the local truncation, and those pages would be silently discarded by cifs_setsize() -\u003e truncate_pagecache().  Fix by acquiring inode_lock (exclusive i_rwsem) and filemap_invalidate_lock at the top of cifs_do_truncate(), so the entire flush-truncate-resize sequence is atomic with respect to:    - buffered writes (blocked by exclusive i_rwsem, since     netfs_start_io_write takes i_rwsem shared),   - read page faults (blocked by exclusive invalidate_lock, since     filemap_fault takes it shared),   - writeback collection (blocked by netfs_wb_begin/netfs_wb_end     around the server truncate and local resize, since     netfs_writepages also acquires the wb lock).",
  "id": "DEBIAN-CVE-2026-99111",
  "modified": "2026-10-29T05:47:26.244854166Z",
  "published": "2026-10-28T11:17:30.520Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99111"
    }
  ],
  "upstream": [
    "CVE-2026-99111"
  ]
}