Description
In the Linux kernel, the following vulnerability has been resolved:

smb: client: restore the data_offset bound in is_valid_oplock_break()

Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
changed the quantity this bound is measured against. It used to be
srv->total_read minus the 4-byte RFC1002 preamble that total_read then
included, so it was the SMB message length. The same commit stopped
counting the preamble, and the mechanical substitution to
srv->total_read - srv->pdu_size left an expression that is identically
zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly
pdu_length - MID_HEADER_SIZE() more, adding both to total_read.

len is therefore 0, the subtraction below it wraps, and no __u32
DataOffset can exceed the result, so the check from commit 097f5863b1a0
("cifs: read overflow in is_valid_oplock_break()") no longer rejects
anything. Use total_read, which is now the message length on its own.
Published: 2026-09-11
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Buffer Under-read in SMB client
Action: Apply Patch
AI Analysis

Impact

The vulnerability stems from a logic error in the SMB client’s data offset validation routine. A counter that should bound the DataOffset field became zero after a wrap‑around subtraction, disabling the bounds check. The result is an out‑of‑bounds read (CWE‑125), allowing an attacker to read bytes beyond the intended buffer in the Linux kernel, potentially exposing kernel memory contents or causing a crash.

Affected Systems

All Linux kernel implementations that contain the buggy code sequence before the fix commit were susceptible. The advisory does not list specific kernel releases; any kernel that incorporates the commits that introduced the bug remains vulnerable until the patch commit restoring proper bounds checking is applied.

Risk and Exploitability

The CVSS score of 9.1 places the vulnerability in the high severity zone, while the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no confirmed public exploits. Attackers would need to craft a specially structured SMB packet, implying a remote SMB attack vector. Despite the low EPSS probability and lack of KEV listing, the potential impact remains significant should an exploit be discovered, so prompt patching is required.

Generated by OpenCVE AI on September 15, 2026 at 21:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that contains the commit restoring proper bounds checking in the SMB client.
  • Use firewall or network segmentation to restrict SMB traffic (TCP port 445) to trusted network segments only, limiting exposure until the patch is deployed.
  • Monitor kernel logs and SMB traffic for anomalies such as repeated large data offset requests or unexpected crashes, and investigate any suspicious activity.

Generated by OpenCVE AI on September 15, 2026 at 21:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H'}

 cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break() Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") changed the quantity this bound is measured against. It used to be srv->total_read minus the 4-byte RFC1002 preamble that total_read then included, so it was the SMB message length. The same commit stopped counting the preamble, and the mechanical substitution to srv->total_read - srv->pdu_size left an expression that is identically zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly pdu_length - MID_HEADER_SIZE() more, adding both to total_read. len is therefore 0, the subtraction below it wraps, and no __u32 DataOffset can exceed the result, so the check from commit 097f5863b1a0 ("cifs: read overflow in is_valid_oplock_break()") no longer rejects anything. Use total_read, which is now the message length on its own.
Title smb: client: restore the data_offset bound in is_valid_oplock_break()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:32:08.588Z

Reserved: 2026-09-11T19:38:34.738Z

Link: CVE-2026-89630

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:48.517

Modified: 2026-09-13T07:17:28.067

Link: CVE-2026-89630

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:45:25Z

Links: CVE-2026-89630 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T21:15:14Z

Weaknesses