CVE-2026-89631 (GCVE-0-2026-89631)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-21 12:48
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData. Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.
References
Impacted products
Vendor Product Version
Linux Linux Version: cc20c031bb067eb3280a1c4b5c42295093e24863
Version: cc20c031bb067eb3280a1c4b5c42295093e24863
Version: cc20c031bb067eb3280a1c4b5c42295093e24863
Version: cc20c031bb067eb3280a1c4b5c42295093e24863
Version: cc20c031bb067eb3280a1c4b5c42295093e24863
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89631",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:24:39.378892Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:45.378Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifssmb.c",
            "fs/smb/client/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d837645a719151ed392d4d9cab4571c2753dab12",
              "status": "affected",
              "version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
              "versionType": "git"
            },
            {
              "lessThan": "2ae219762ebac929bf6ab3473681f10ed566af08",
              "status": "affected",
              "version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
              "versionType": "git"
            },
            {
              "lessThan": "3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d",
              "status": "affected",
              "version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
              "versionType": "git"
            },
            {
              "lessThan": "411e484fe71a7f1028de617447edad9cb6d9d68a",
              "status": "affected",
              "version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
              "versionType": "git"
            },
            {
              "lessThan": "65deb18359341141d37dc86fc7853511be3c87a7",
              "status": "affected",
              "version": "cc20c031bb067eb3280a1c4b5c42295093e24863",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifssmb.c",
            "fs/smb/client/trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject a tree connect response whose byte count is too small\n\nCIFSTCon() bounds its strnlen() over the byte area with the server\u0027s\nByteCount minus two, which for ByteCount 0 or 1 goes negative as an int\nand converts to a huge size_t.  The later subtraction wraps the __u16\nbytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of\nup to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the\nslab object, and the bytes reach userspace through tcon-\u003enativeFileSystem\nin /proc/fs/cifs/DebugData.\n\nReject a byte area too small for what the parser consumes.  Two bytes is\nthe least it can consume, and no conformant response carries fewer.  The\nnew trace point is the 129th smb_eio_trace entry, which __mode(byte)\ncannot represent, so the attribute goes with it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - CIFSTCon() parses a TREE_CONNECT_ANDX response received over TCP (typically port 445) from the SMB peer, so a malicious or compromised CIFS server supplies the undersized ByteCount remotely.\nAC:L - A server that returns success with ByteCount 0 or 1 triggers the integer underflow and wrapped 65535-byte bound deterministically; CONFIG_CIFS_ALLOW_INSECURE_LEGACY defaults to y, and no race or uncontrolled memory layout is required.\nPR:N - The attacker is the remote SMB server (or a MITM on unsigned SMB1); the client authenticates to that peer, so no account, capability, or privilege on the victim host is required.\nUI:N - Existing SMB1 mounts, IPC tcons, automounts, fstab, and cifsroot reconnect via cifs_tree_connect() after a server-induced TCP drop, so the crafted TREE_CONNECT response is processed without contemporaneous user action.\nS:U - The out-of-bounds slab read, kernel-memory leak, and possible oops remain inside the client kernel\u0027s security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - ByteCount underflow wraps the __u16 bound to up to 65535 bytes against a ~16KB cifs_request slab, so cifs_strndup_from_utf16() copies adjacent kernel heap into tcon-\u003enativeFileSystem, which is then exposed through /proc/fs/cifs/DebugData.\nI:N - The defect is an out-of-bounds read copied into a newly allocated, correctly sized string; it does not write outside that allocation or provide an arbitrary-write or control-flow primitive.\nA:H - strnlen(), kstrndup(), and cifs_utf16_bytes() walk tens of kilobytes past the cifs_request object into unmapped or guarded pages, causing a kernel oops or panic that a malicious peer can retrigger on reconnect."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:48:03.355Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d837645a719151ed392d4d9cab4571c2753dab12"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ae219762ebac929bf6ab3473681f10ed566af08"
        },
        {
          "url": "https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a"
        },
        {
          "url": "https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7"
        }
      ],
      "title": "smb: client: reject a tree connect response whose byte count is too small",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89631",
    "datePublished": "2026-09-11T19:45:26.444Z",
    "dateReserved": "2026-09-11T19:38:34.738Z",
    "dateUpdated": "2026-10-21T12:48:03.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-89631\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:24:39.378892Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:24:40.423Z\"}}], \"cna\": {\"title\": \"smb: client: reject a tree connect response whose byte count is too small\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - CIFSTCon() parses a TREE_CONNECT_ANDX response received over TCP (typically port 445) from the SMB peer, so a malicious or compromised CIFS server supplies the undersized ByteCount remotely.\\nAC:L - A server that returns success with ByteCount 0 or 1 triggers the integer underflow and wrapped 65535-byte bound deterministically; CONFIG_CIFS_ALLOW_INSECURE_LEGACY defaults to y, and no race or uncontrolled memory layout is required.\\nPR:N - The attacker is the remote SMB server (or a MITM on unsigned SMB1); the client authenticates to that peer, so no account, capability, or privilege on the victim host is required.\\nUI:N - Existing SMB1 mounts, IPC tcons, automounts, fstab, and cifsroot reconnect via cifs_tree_connect() after a server-induced TCP drop, so the crafted TREE_CONNECT response is processed without contemporaneous user action.\\nS:U - The out-of-bounds slab read, kernel-memory leak, and possible oops remain inside the client kernel\u0027s security authority and do not cross a VM, IOMMU, or sandbox boundary.\\nC:H - ByteCount underflow wraps the __u16 bound to up to 65535 bytes against a ~16KB cifs_request slab, so cifs_strndup_from_utf16() copies adjacent kernel heap into tcon-\u003enativeFileSystem, which is then exposed through /proc/fs/cifs/DebugData.\\nI:N - The defect is an out-of-bounds read copied into a newly allocated, correctly sized string; it does not write outside that allocation or provide an arbitrary-write or control-flow primitive.\\nA:H - strnlen(), kstrndup(), and cifs_utf16_bytes() walk tens of kilobytes past the cifs_request object into unmapped or guarded pages, causing a kernel oops or panic that a malicious peer can retrigger on reconnect.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"cc20c031bb067eb3280a1c4b5c42295093e24863\", \"lessThan\": \"d837645a719151ed392d4d9cab4571c2753dab12\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cc20c031bb067eb3280a1c4b5c42295093e24863\", \"lessThan\": \"2ae219762ebac929bf6ab3473681f10ed566af08\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cc20c031bb067eb3280a1c4b5c42295093e24863\", \"lessThan\": \"3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cc20c031bb067eb3280a1c4b5c42295093e24863\", \"lessThan\": \"411e484fe71a7f1028de617447edad9cb6d9d68a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cc20c031bb067eb3280a1c4b5c42295093e24863\", \"lessThan\": \"65deb18359341141d37dc86fc7853511be3c87a7\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/smb/client/cifssmb.c\", \"fs/smb/client/trace.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.114\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.*\"}, {\"status\": \"unaffected\", \"version\": \"7.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/smb/client/cifssmb.c\", \"fs/smb/client/trace.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d837645a719151ed392d4d9cab4571c2753dab12\"}, {\"url\": \"https://git.kernel.org/stable/c/2ae219762ebac929bf6ab3473681f10ed566af08\"}, {\"url\": \"https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d\"}, {\"url\": \"https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a\"}, {\"url\": \"https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: reject a tree connect response whose byte count is too small\\n\\nCIFSTCon() bounds its strnlen() over the byte area with the server\u0027s\\nByteCount minus two, which for ByteCount 0 or 1 goes negative as an int\\nand converts to a huge size_t.  The later subtraction wraps the __u16\\nbytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of\\nup to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the\\nslab object, and the bytes reach userspace through tcon-\u003enativeFileSystem\\nin /proc/fs/cifs/DebugData.\\n\\nReject a byte area too small for what the parser consumes.  Two bytes is\\nthe least it can consume, and no conformant response carries fewer.  The\\nnew trace point is the 129th smb_eio_trace entry, which __mode(byte)\\ncannot represent, so the attribute goes with it.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.160\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.114\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.51\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.4\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-21T12:48:03.355Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-89631\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-21T12:48:03.355Z\", \"dateReserved\": \"2026-09-11T19:38:34.738Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-09-11T19:45:26.444Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.