CVE-2026-89632 Overview
CVE-2026-89632 is an out-of-bounds read vulnerability in the Linux kernel's SMB client. The flaw resides in the reparse_buf_ptr() function, which reads the ReparseDataLength field before validating that the received data covers the full fixed header. A malicious or malformed SMB server response with OutputCount < 6 can trigger a read past the end of the received buffer.
The vulnerability affects Linux kernel builds that include the SMB client (smb: client) code path handling reparse point data. Exploitation requires interaction with an attacker-controlled or compromised SMB server.
Critical Impact
A malicious SMB server can trigger an out-of-bounds read in the Linux kernel, potentially causing kernel memory disclosure or a denial-of-service condition on clients mounting attacker-controlled shares.
Affected Products
- Linux kernel — SMB client (fs/smb/client) reparse point handling
- Kernel builds prior to the fix commits 05f78e6cf34e and 711cf71300d7
- Systems mounting SMB/CIFS shares from untrusted or attacker-influenced servers
Discovery Timeline
- 2026-09-11 - CVE-2026-89632 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89632
Vulnerability Analysis
The defect is a use-before-check pattern in the SMB client's reparse_buf_ptr() function. The code casts an incoming buffer to struct reparse_data_buffer and reads the 16-bit ReparseDataLength field at offset 4 before verifying that count is at least sizeof(*buf) (8 bytes). When an SMB server returns an OutputCount value smaller than 6, the read at offsets 4–5 accesses memory beyond the validated region.
While the surrounding code validates off + count against iov_len, that boundary check does not guarantee count itself is large enough to contain the fixed reparse header. The result is an out-of-bounds read [CWE-125] inside kernel address space.
The upstream fix splits the validation into two steps: verify count >= sizeof(*buf) before reading ReparseDataLength, then verify count covers the variable data region indicated by rdlen + len.
Root Cause
The root cause is improper ordering of input validation. The function dereferenced attacker-controlled length fields before confirming the buffer was large enough to contain those fields. The struct reparse_data_buffer layout places ReparseDataLength at offset 4, so any count value below 6 causes the little-endian conversion of buf->ReparseDataLength to read uninitialized or adjacent kernel memory.
Attack Vector
Exploitation requires a Linux client to communicate with a malicious SMB server. The attacker crafts a response containing a reparse point buffer with OutputCount set below the size of the fixed header. When the client processes the response, reparse_buf_ptr() reads past the end of the receive buffer. This can produce kernel memory disclosure through subsequent processing paths or trigger a kernel crash, depending on adjacent memory contents and allocator behavior.
No authentication to the client is required. The precondition is that the victim mounts or accesses a share hosted by the attacker.
See the upstream fixes for exact code changes: kernel commit 05f78e6cf34e and kernel commit 711cf71300d7.
Detection Methods for CVE-2026-89632
Indicators of Compromise
- Unexpected kernel oops or KASAN: slab-out-of-bounds reports referencing reparse_buf_ptr or smb2_ioctl call paths in dmesg.
- SMB sessions to untrusted or newly observed external servers immediately preceding kernel instability.
- Repeated short SMB IOCTL responses with OutputCount values below 8 bytes observed in packet captures.
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test hosts to catch out-of-bounds reads in the SMB client path during fuzzing or QA.
- Monitor kernel logs for cifs/smb client warnings and panics correlated with recent share mounts.
- Inspect SMB traffic for anomalous reparse point responses where declared length fields are inconsistent with payload size.
Monitoring Recommendations
- Collect and centralize kernel ring buffer logs from Linux endpoints and servers that mount SMB shares.
- Alert on new outbound SMB sessions (TCP 445) to non-corporate destinations from server and workstation subnets.
- Track kernel version inventory to identify hosts still running pre-patch builds.
How to Mitigate CVE-2026-89632
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 05f78e6cf34e and 711cf71300d7 as soon as vendor-backported builds are available.
- Restrict Linux SMB client connections to trusted, authenticated internal servers only.
- Audit mount points and automount configurations to remove references to untrusted SMB endpoints.
Patch Information
The fix reorders validation in reparse_buf_ptr() to check count >= sizeof(*buf) before reading buf->ReparseDataLength, then verifies count >= rdlen + len before accessing the data region. Distribution kernels should incorporate the changes from kernel commit 05f78e6cf34e and kernel commit 711cf71300d7. Consult your distribution's security tracker for backported package versions.
Workarounds
- Block outbound TCP 445 at perimeter firewalls to prevent Linux clients from reaching attacker-controlled SMB servers on the internet.
- Unload the cifs kernel module (modprobe -r cifs) on hosts that do not require SMB client functionality.
- Enforce SMB signing and require Kerberos-authenticated mounts to reduce exposure to rogue server responses.
# Configuration example: disable SMB client where not required
sudo modprobe -r cifs
echo 'blacklist cifs' | sudo tee /etc/modprobe.d/disable-cifs.conf
# Verify running kernel version against patched build
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
