CVE-2026-89631 - Vulnerability Details

- smb: client: reject a tree connect response whose byte count is too small

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject a tree connect response whose byte count is too small

CIFSTCon() bounds its strnlen() over the byte area with the server's
ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int
and converts to a huge size_t. The later subtraction wraps the __u16
bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of
up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the
slab object, and the bytes reach userspace through tcon->nativeFileSystem
in /proc/fs/cifs/DebugData.

Reject a byte area too small for what the parser consumes. Two bytes is
the least it can consume, and no conformant response carries fewer. The
new trace point is the 129th smb_eio_trace entry, which __mode(byte)
cannot represent, so the attribute goes with it.

Published: 2026-09-11

Score: 9.1 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s CIF with a ByteCount of 0 or 1 as a signed integer, then uses the resulting huge size_t to copy a UTF‑16 string from a slab buffer. The bounds check in CIFS_STRNDUP_FROM_UTF16 is bypassed, causing an out‑of‑bounds read that leaks kernel memory contents into the debug file exposed under /proc/fs/cifs/DebugData. The weakness is a classic buffer over‑read (CWE‑125).

Affected Systems

All Linux kernel releases that include the CIFS SMB client and have not yet applied the fix are potentially vulnerable. This includes distributions that load the default CIFS module with a kernel prior to the patch delivery.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.1, reported as < 1 %, showing a very low but nonzero exploitation likelihood. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must control an SMB server to send a crafted tree‑connect response while the client accepts it. Once the exploit triggers, any user who can read /proc/fs/cifs/DebugData can obtain leaked kernel data, but the flaw provides no direct code execution or privilege escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cc20c031bb067eb3280a1c4b5c42295093e24863`	affected	< 3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d
`cc20c031bb067eb3280a1c4b5c42295093e24863`	affected	< 411e484fe71a7f1028de617447edad9cb6d9d68a
`cc20c031bb067eb3280a1c4b5c42295093e24863`	affected	< 65deb18359341141d37dc86fc7853511be3c87a7

Linux

affected

Version	Status	Constraints
`2.6.30`	affected	—
`0`	unaffected	< 2.6.30
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cc20c031bb067eb3280a1c4b5c42295093e24863,3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d)`	affected	code_commit	—
`[cc20c031bb067eb3280a1c4b5c42295093e24863,411e484fe71a7f1028de617447edad9cb6d9d68a)`	affected	code_commit	—
`[cc20c031bb067eb3280a1c4b5c42295093e24863,65deb18359341141d37dc86fc7853511be3c87a7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.30`	affected	semver	—
`[0,2.6.30)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the CVE‑2026‑89631 fix.
Restrict read access to /proc/fs/cifs/DebugData, for example by setting appropriate file permissions or using SELinux/AppArmor rules.
If an immediate kernel upgrade is not possible, unload the CIFS module or cease using SMB mounts until the patch is available.

Generated by OpenCVE AI on September 15, 2026 at 21:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00632.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d
https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a
https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7
https://nvd.nist.gov/vuln/detail/CVE-2026-89631
https://www.cve.org/CVERecord?id=CVE-2026-89631

History

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'}`	cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89631 https://www.cve.org/CVERecord?id=CVE-2026-89631
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData. Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.
Title		smb: client: reject a tree connect response whose byte count is too small
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:26.444Z

Updated: 2026-09-13T06:32:09.832Z

Reserved: 2026-09-11T19:38:34.738Z

Link: CVE-2026-89631

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:48.640

Modified: 2026-09-13T07:17:28.183

Link: CVE-2026-89631

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:45:26Z

Links: CVE-2026-89631 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T21:15:14Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object