CVE-2026-89631 - Vulnerability Details

- smb: client: reject a tree connect response whose byte count is too small

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject a tree connect response whose byte count is too small

CIFSTCon() bounds its strnlen() over the byte area with the server's
ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int
and converts to a huge size_t. The later subtraction wraps the __u16
bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of
up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the
slab object, and the bytes reach userspace through tcon->nativeFileSystem
in /proc/fs/cifs/DebugData.

Reject a byte area too small for what the parser consumes. Two bytes is
the least it can consume, and no conformant response carries fewer. The
new trace point is the 129th smb_eio_trace entry, which __mode(byte)
cannot represent, so the attribute goes with it.

Published: 2026-09-11

Score: 5.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A contain a ByteCount of zero or one. The kernel interprets this value as a signed integer, converts it to a very large size_t, and then uses that value to copy a UTF‑16 string from a slab buffer. The copy overruns the buffer bounds, leaking data from kernel memory into a debug file exposed under /proc/fs/cifs/DebugData. The flaw is a classic out‑of‑bounds read (CWE‑125).

Affected Systems

All Linux kernel releases that include the CIFS SMB client and have not yet installed the patch that This includes every system with the default CIFS module loaded and the are kernel using CIFS is potentially vulnerable.

Risk and Exploitability

The reported CVSS score of 5.7 indicates a medium severity; 0.17% shows a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need remote control of an SMB server to send a crafted tree connect response that triggers the over‑read. A user with access to /proc/fs/cifs/DebugData could then read the leaked kernel data. The flaw does not provide direct execution or privilege escalation, so local users without CIFS traffic cannot exploit it.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cc20c031bb067eb3280a1c4b5c42295093e24863`	affected	< 3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d
`cc20c031bb067eb3280a1c4b5c42295093e24863`	affected	< 411e484fe71a7f1028de617447edad9cb6d9d68a
`cc20c031bb067eb3280a1c4b5c42295093e24863`	affected	< 65deb18359341141d37dc86fc7853511be3c87a7

Linux

affected

Version	Status	Constraints
`2.6.30`	affected	—
`0`	unaffected	< 2.6.30
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cc20c031bb067eb3280a1c4b5c42295093e24863,3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d)`	affected	code_commit	—
`[cc20c031bb067eb3280a1c4b5c42295093e24863,411e484fe71a7f1028de617447edad9cb6d9d68a)`	affected	code_commit	—
`[cc20c031bb067eb3280a1c4b5c42295093e24863,65deb18359341141d37dc86fc7853511be3c87a7)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.30`	affected	semver	—
`[0,2.6.30)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the fix for CVE‑2026‑89631.
Remove or restrict the /proc/fs/cifs/DebugData entry to prevent appropriate permissions or remove the export).
If a kernel upgrade is not yet possible, disable CIFS mounts or unload the CIFS client module until the patch is applied.

Generated by OpenCVE AI on September 13, 2026 at 00:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d
https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a
https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7
https://nvd.nist.gov/vuln/detail/CVE-2026-89631
https://www.cve.org/CVERecord?id=CVE-2026-89631

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89631 https://www.cve.org/CVERecord?id=CVE-2026-89631
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData. Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.
Title		smb: client: reject a tree connect response whose byte count is too small
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:45:26.444Z

Updated: 2026-09-11T19:45:26.444Z

Reserved: 2026-09-11T19:38:34.738Z

Link: CVE-2026-89631

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:48.640

Modified: 2026-09-11T20:19:48.640

Link: CVE-2026-89631

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:45:26Z

Links: CVE-2026-89631 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T00:45:17Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object