CVE-2026-89631: Linux Kernel SMB Client Buffer Overflow

CVE-2026-89631 Overview

CVE-2026-89631 is an out-of-bounds read vulnerability in the Linux kernel's SMB/CIFS client. The flaw resides in the CIFSTCon() function, which processes tree connect responses from SMB servers. A malicious or compromised server can return a ByteCount value of 0 or 1, triggering an integer sign conversion that produces a huge size_t bound for strnlen(). The resulting read extends beyond the ~16 KB cifs_req_poolp slab object, and the leaked bytes reach userspace through tcon->nativeFileSystem exposed in /proc/fs/cifs/DebugData.

Critical Impact
A remote SMB server can force the Linux kernel CIFS client to read memory past a slab allocation and expose kernel heap contents to userspace, enabling information disclosure and potential denial of service.

Affected Products

Linux kernel smb/client (CIFS) subsystem
Kernel branches receiving the fix in commits 3be89e8039, 411e484fe7, and 65deb18359
Systems mounting SMB/CIFS shares from untrusted or attacker-controlled servers

Discovery Timeline

2026-09-11 - CVE-2026-89631 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89631

Vulnerability Analysis

The vulnerability lives in CIFSTCon(), the SMB1 tree connect response parser in the Linux kernel CIFS client. The parser calls strnlen() across the response's byte area using the server-supplied ByteCount minus two as the length bound. When ByteCount is 0 or 1, the subtraction produces a negative int that promotes to a very large size_t. The subsequent decrement of the __u16 bytes_left counter wraps around, and that wrapped value is passed to cifs_strndup_from_utf16() as the bound for a UTF-16 copy operation.

The resulting bound can reach 65535 bytes against a cifs_req_poolp slab object of only about 16 KB. The kernel therefore reads well past the allocation boundary. Those bytes populate tcon->nativeFileSystem and become visible to any local reader of /proc/fs/cifs/DebugData, converting a server-side protocol trick into a kernel heap disclosure primitive.

Root Cause

The root cause is missing lower-bound validation on the SMB tree connect ByteCount field combined with a signed/unsigned conversion. The parser assumes the byte area contains at least the two bytes it will consume, but never verifies that assumption before performing arithmetic that underflows.

Attack Vector

An attacker controlling or impersonating an SMB server crafts a SMB_COM_TREE_CONNECT_ANDX response whose ByteCount header is 0 or 1. When a Linux client connects and mounts a share, the malformed response drives the out-of-bounds read. No client-side authentication step protects the parser, because the flaw is reached during connection setup. Adjacent slab contents subsequently leak through /proc/fs/cifs/DebugData.

No verified proof-of-concept code has been published. See the upstream commits 3be89e8039, 411e484fe7, and 65deb18359 for the patch details.

Detection Methods for CVE-2026-89631

Indicators of Compromise

Unexpected or unusually short SMB tree connect responses observed on port 445 traffic captures, particularly responses with ByteCount values below 2.
Kernel log entries from the CIFS subsystem referencing malformed tree connect responses or the new smb_eio_trace tracepoint added by the fix.
Non-printable or binary content appearing in the nativeFileSystem field within /proc/fs/cifs/DebugData.

Detection Strategies

Deploy network intrusion detection signatures that flag SMB1 TREE_CONNECT_ANDX responses with ByteCount fields less than 2.
Enable and monitor the CIFS client tracepoints, including the smb_eio_trace entry introduced with the patch, to surface rejected responses.
Audit endpoints for outbound SMB connections to servers outside the corporate network or to unexpected IP ranges.

Monitoring Recommendations

Baseline which hosts mount SMB shares and alert on new client-to-server pairs, especially to internet-reachable SMB endpoints.
Track reads of /proc/fs/cifs/DebugData by non-root or unexpected processes, since this file is the userspace exposure surface for the leaked bytes.
Correlate kernel ring buffer messages with SMB session establishment events to identify repeated malformed responses from the same server.

How to Mitigate CVE-2026-89631

Immediate Actions Required

Apply the upstream kernel fixes referenced in commits 3be89e8039, 411e484fe7, and 65deb18359 as soon as distribution packages become available.
Restrict outbound SMB (TCP 445, 139) from workstations and servers to known, trusted file server IPs using host or network firewalls.
Disable the CIFS client (cifs.ko) on hosts that do not need to mount SMB shares.

Patch Information

The fix rejects any SMB tree connect response whose byte area is too small for the parser to safely consume, requiring at least two bytes. It also introduces a new smb_eio_trace tracepoint entry to surface rejections. Patches are available in the mainline and stable kernel trees via commit 3be89e8039, commit 411e484fe7, and commit 65deb18359.

Workarounds

Blocklist or unload the cifs kernel module on systems that do not require SMB mounts: modprobe -r cifs and add it to /etc/modprobe.d/blacklist.conf.
Restrict read access to /proc/fs/cifs/DebugData so unprivileged users cannot retrieve leaked bytes, and set CIFS debug options to their most conservative values.
Only mount SMB shares from trusted servers over authenticated, integrity-protected sessions, and prefer SMB3 with signing and encryption where the server supports it.

bash

# Disable the CIFS client module on systems that do not need SMB
sudo modprobe -r cifs
echo "blacklist cifs" | sudo tee /etc/modprobe.d/disable-cifs.conf

# Block outbound SMB to untrusted destinations
sudo iptables -A OUTPUT -p tcp --dport 445 -m conntrack --ctstate NEW -j DROP
sudo iptables -A OUTPUT -p tcp --dport 139 -m conntrack --ctstate NEW -j DROP

# Restrict access to the CIFS debug interface
sudo chmod 600 /proc/fs/cifs/DebugData