CVE-2026-89630 Overview
CVE-2026-89630 is a Linux kernel vulnerability in the SMB (Server Message Block) client code path, specifically inside the is_valid_oplock_break() function. A prior refactor that removed the RFC1002 header from smb_hdr inadvertently reduced a bounds check to an always-zero expression. As a result, the DataOffset sanity check no longer rejects malformed values, reintroducing the read overflow that commit 097f5863b1a0 had originally fixed. A remote SMB server can send a crafted oplock break message to trigger the condition against a Linux SMB client.
Critical Impact
A malicious or compromised SMB server can send a crafted oplock break packet that causes the Linux kernel SMB client to read out of bounds, leading to information disclosure or a kernel crash (denial of service).
Affected Products
- Linux kernel SMB/CIFS client (fs/smb/client)
- Kernel builds containing commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") without the fix
- Distributions shipping vulnerable stable kernel branches until backports land
Discovery Timeline
- 2026-09-11 - CVE-2026-89630 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89630
Vulnerability Analysis
The SMB client function is_valid_oplock_break() validates that the server-supplied DataOffset field points inside the received message. The original guard, added in commit 097f5863b1a0 ("cifs: read overflow in is_valid_oplock_break()"), compared DataOffset against srv->total_read minus the 4-byte RFC1002 preamble. Commit 83bfbd0bb902 removed the preamble from total_read accounting and mechanically substituted srv->total_read - srv->pdu_size into the check.
After that change, the subtraction is identically zero. standard_receive3() reads MID_HEADER_SIZE() bytes followed by exactly pdu_length - MID_HEADER_SIZE() more bytes, adding both to total_read, which makes total_read equal to pdu_size. The computed length becomes zero, the subsequent subtraction wraps as unsigned arithmetic, and no __u32 DataOffset value can exceed the wrapped result. The check therefore accepts every value, reintroducing the read overflow condition.
Root Cause
The root cause is an incorrect bounds computation following a refactor of SMB header handling. The intended invariant — that DataOffset fits within the message length — was silently broken when the quantity used in the comparison lost its semantic meaning. This is an Out-of-Bounds Read stemming from a boundary condition error in input validation.
Attack Vector
An attacker in a position to serve or impersonate an SMB server communicating with a vulnerable Linux client can send a crafted oplock break notification. The client parses the notification with an unbounded DataOffset, dereferencing memory outside the received packet buffer. Depending on adjacent kernel memory contents, the outcome is disclosure of kernel data or a kernel oops resulting in denial of service. No user interaction or authentication on the client is required beyond an established SMB session to the malicious server.
Exploitation code is not publicly available. See the upstream fix in Kernel Git Commit 5b16a19 and Kernel Git Commit ba22f57 for the exact code path.
Detection Methods for CVE-2026-89630
Indicators of Compromise
- Kernel oops or panic messages referencing is_valid_oplock_break, cifs, or smb modules in dmesg or /var/log/kern.log.
- Unexpected SMB client disconnects or session resets shortly after receiving an oplock break notification.
- SMB traffic from untrusted or unexpected servers targeting Linux clients on TCP port 445.
Detection Strategies
- Inventory running kernels and compare against distribution advisories referencing commits 5b16a1967a01 and ba22f575de9d to identify unpatched hosts.
- Inspect SMB packet captures for oplock break responses carrying malformed DataOffset fields that exceed the actual message length.
- Alert on Linux hosts establishing outbound SMB sessions to servers outside sanctioned file-server ranges.
Monitoring Recommendations
- Forward kernel logs to a centralized analytics platform and create rules for SMB/CIFS module faults.
- Monitor for repeated SMB reconnection attempts from Linux clients that may indicate crash-and-restart loops.
- Track egress connections to TCP/445 from workstations and servers that are not expected to mount remote SMB shares.
How to Mitigate CVE-2026-89630
Immediate Actions Required
- Apply the upstream kernel fix from Kernel Git Commit 5b16a19 or a distribution kernel update that incorporates it.
- Restrict outbound SMB (TCP/445) traffic from Linux clients to a controlled allow-list of trusted file servers.
- Unload the cifs kernel module on hosts that do not require SMB client functionality until patches are deployed.
Patch Information
The fix restores the original semantics of the bounds check by using total_read, which now represents the full SMB message length after the RFC1002 preamble removal. Backports are available for affected stable branches via Kernel Git Commit ba22f57. Apply the vendor-supplied kernel package and reboot to activate the patched code path.
Workarounds
- Block outbound TCP/445 at host or network firewalls for systems that do not need SMB client access.
- Prevent automatic loading of the cifs module using a modprobe blacklist entry on hosts without SMB requirements.
- Ensure Linux clients only mount SMB shares from authenticated, trusted servers on isolated network segments.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.