CVE-2026-89631
UnknownSummary
In the Linux kernel SMB client, CIFSTCon() bounds its strnlen() by the server's ByteCount minus two, which for ByteCount 0 or 1 becomes negative as an int and converts to a huge size_t. The later subtraction wraps __u16 bytes_left, allowing cifs_strndup_from_utf16() to read up to 65535 bytes from a ~16 KB object, leaking data through /proc/fs/cifs/DebugData.
Risk Assessment
Possible out-of-bounds read of a heap object and leak of kernel data to userspace via /proc/fs/cifs/DebugData, triggered by a malicious SMB server.
Recommendation
Update the Linux kernel to a version containing the fix that rejects tree connect responses with a byte area smaller than two bytes.
Other vulnerabilities in Linux kernel (SMB client)
See all- CVE-2026-89637Unknown
In the Linux kernel SMB client, cifs_check_trans2() returning false for a malformed secondary T2 response (invalid SMB header or PDU rejected by check2ndT2()) causes handle_mid() to overwrite mid->resp_buf with the new buffer, leaking the primary buffer and leaving server->smallbuf/bigbuf dangling. This results in a use-after-free when the demux thread reuses the freed buffer.
- CVE-2026-89636Unknown
In the Linux kernel SMB client, free_tgts() frees all structures in ce->tlist but leaves ce->tgthint pointing to one of the freed cache_dfs_tgt structures. If the pointer is not reset before later use, a use-after-free occurs.
- CVE-2026-89634Unknown
In the Linux kernel SMB client, the ALIGN() macro in symlink_data() can overflow for ErrorDataLength values near UINT32_MAX (e.g. 0xFFFFFFF9), wrapping to 0. This causes the bounds check to pass and the loop to advance by zero bytes, leaving pointer 'p' pointing into stale data.
- CVE-2026-89633Unknown
In the Linux kernel SMB client, coalesce_t2() computes data pointers directly from server-supplied DataOffset fields without validating them against buffer bounds. A small DataOffset can push a pointer below the data area and overwrite header fields, while a large one can push it past the buffer end, causing out-of-bounds heap reads or writes.
- CVE-2026-89632Unknown
In the Linux kernel SMB client, reparse_buf_ptr() reads the ReparseDataLength field before verifying that the received data covers the full fixed header. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data.
- CVE-2026-46139Medium
A vulnerability has been identified in the Linux kernel SMB client related to improper initialization of the security descriptor buffer. A change in the data structure caused the reserved field to remain uninitialized, leading to errors when attempting to use chmod.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData. Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.