CVE-2026-89632
UnknownSummary
In the Linux kernel SMB client, reparse_buf_ptr() reads the ReparseDataLength field before verifying that the received data covers the full fixed header. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data.
Risk Assessment
Possible out-of-bounds read of the received buffer while processing an SMB server response, which may lead to data disclosure or kernel instability.
Recommendation
Update the Linux kernel to a version containing the fix that first verifies count >= sizeof(*buf) and then verifies the data region is covered.
Other vulnerabilities in Linux kernel (SMB client)
See all- CVE-2026-89637Unknown
In the Linux kernel SMB client, cifs_check_trans2() returning false for a malformed secondary T2 response (invalid SMB header or PDU rejected by check2ndT2()) causes handle_mid() to overwrite mid->resp_buf with the new buffer, leaking the primary buffer and leaving server->smallbuf/bigbuf dangling. This results in a use-after-free when the demux thread reuses the freed buffer.
- CVE-2026-89636Unknown
In the Linux kernel SMB client, free_tgts() frees all structures in ce->tlist but leaves ce->tgthint pointing to one of the freed cache_dfs_tgt structures. If the pointer is not reset before later use, a use-after-free occurs.
- CVE-2026-89634Unknown
In the Linux kernel SMB client, the ALIGN() macro in symlink_data() can overflow for ErrorDataLength values near UINT32_MAX (e.g. 0xFFFFFFF9), wrapping to 0. This causes the bounds check to pass and the loop to advance by zero bytes, leaving pointer 'p' pointing into stale data.
- CVE-2026-89633Unknown
In the Linux kernel SMB client, coalesce_t2() computes data pointers directly from server-supplied DataOffset fields without validating them against buffer bounds. A small DataOffset can push a pointer below the data area and overwrite header fields, while a large one can push it past the buffer end, causing out-of-bounds heap reads or writes.
- CVE-2026-89631Unknown
In the Linux kernel SMB client, CIFSTCon() bounds its strnlen() by the server's ByteCount minus two, which for ByteCount 0 or 1 becomes negative as an int and converts to a huge size_t. The later subtraction wraps __u16 bytes_left, allowing cifs_strndup_from_utf16() to read up to 65535 bytes from a ~16 KB object, leaking data through /proc/fs/cifs/DebugData.
- CVE-2026-46139Medium
A vulnerability has been identified in the Linux kernel SMB client related to improper initialization of the security descriptor buffer. A change in the data structure caused the reserved field to remain uninitialized, leading to errors when attempting to use chmod.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() reparse_buf_ptr() reads buf->ReparseDataLength before checking that count covers the full fixed header: buf = (struct reparse_data_buffer *)((u8 *)io + off); len = sizeof(*buf); /* 8 bytes */ rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */ if (count < len || count < rdlen + len) /* check comes after */ struct reparse_data_buffer has ReparseDataLength at offset 4. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data. The off+count bounds against iov_len were already validated, but that does not protect against count being smaller than sizeof(*buf). Split the check: verify count >= sizeof(*buf) before reading ReparseDataLength, then verify count covers the data region.