CVE-2026-89633 Overview
CVE-2026-89633 is a critical out-of-bounds read/write vulnerability in the Linux kernel's SMB client. The flaw resides in the coalesce_t2() function, which computes data pointers directly from server-supplied DataOffset fields without validating them against buffer bounds. A malicious or compromised SMB server can send a crafted Transaction2 (T2) response that causes the client to read from or write to memory outside the allocated SMB buffer. This can corrupt adjacent heap data or leak sensitive kernel memory. The vulnerability is remotely exploitable over the network without authentication or user interaction.
Critical Impact
A malicious SMB server can trigger out-of-bounds heap reads and writes in the Linux kernel, potentially leading to remote code execution or information disclosure on connected SMB clients.
Affected Products
- Linux kernel SMB client (fs/smb/client)
- Distributions shipping unpatched Linux kernels with the cifs/smb client module
- Systems mounting remote SMB shares from untrusted or attacker-controlled servers
Discovery Timeline
- 2026-09-11 - CVE-2026-89633 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89633
Vulnerability Analysis
The defect lives in coalesce_t2() within the Linux kernel's SMB client code. The function merges multiple T2 response fragments by copying data from a source buffer into a target buffer. It calculates both source and destination data areas by adding the server-controlled DataOffset field to the SMB protocol header pointer.
Because no bounds checks exist, a small DataOffset value can push the computed pointer below the byte area of the buffer, allowing the subsequent memcpy() to overwrite adjacent header fields. A large DataOffset value can push the pointer past the end of the allocated buffer, producing an out-of-bounds heap read from the source or an out-of-bounds heap write into the target. The pre-existing byte count (BCC) overflow guard is insufficient because BCC only reflects payload size, not its offset within the buffer.
A comment reading "validate target area" has existed in the function since 2005 as a placeholder that was never implemented. The patch introduces both lower- and upper-bound checks for the source and target data pointers before any memcpy() operation and before any target header fields are modified.
Root Cause
The root cause is missing input validation on the DataOffset field parsed from an untrusted SMB server response. This is an Out-of-Bounds Read and Out-of-Bounds Write flaw resulting from trusting server-supplied offsets without verifying that the resulting pointer arithmetic remains inside the allocated buffer.
Attack Vector
The attack vector is network-based. An attacker who controls an SMB server, or who can perform a man-in-the-middle attack against an SMB session, sends a malformed T2 response containing a manipulated DataOffset. When the Linux SMB client processes the response through coalesce_t2(), the resulting pointer arithmetic references memory outside the SMB buffer. Exploitation requires no local access, no credentials, and no user interaction beyond the client mounting or communicating with the malicious share.
The vulnerability mechanism is documented in the upstream kernel commits referenced by Kernel Git Commit 672cf86, Kernel Git Commit 033bc80, and Kernel Git Commit 6343c1d.
Detection Methods for CVE-2026-89633
Indicators of Compromise
- Unexpected kernel oops, BUG, or KASAN reports referencing coalesce_t2 or the cifs/smb client module in dmesg or /var/log/kern.log.
- SMB client kernel panics or crashes shortly after mounting or communicating with a remote SMB share.
- Outbound SMB (TCP/445) sessions to untrusted or unexpected hosts on Linux clients or servers.
Detection Strategies
- Monitor kernel logs for stack traces implicating coalesce_t2(), cifs_demultiplex_thread, or SMB2/CIFS response handling code paths.
- Inspect network telemetry for Linux hosts establishing SMB sessions with external or non-corporate SMB endpoints.
- Use packet capture or IDS signatures to flag SMB Transaction2 responses containing anomalously small or large DataOffset values relative to declared byte counts.
Monitoring Recommendations
- Enable KASAN in test environments to surface out-of-bounds accesses in the SMB client during fuzzing and validation.
- Alert on kernel crashes on hosts that mount SMB shares and correlate them with recent SMB traffic.
- Track deployed kernel versions across the fleet to identify hosts running unpatched builds.
How to Mitigate CVE-2026-89633
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 672cf86, 033bc80, and 6343c1d as soon as vendor-supplied packages are available.
- Restrict outbound SMB (TCP/445) traffic from Linux hosts to trusted, known-good file servers only.
- Unmount SMB shares from untrusted sources and avoid connecting to SMB endpoints outside the corporate perimeter.
Patch Information
The fix adds lower- and upper-bound checks for both source and target data pointers in coalesce_t2() before the memcpy() and before any target header fields are modified. Refer to Kernel Git Commit 672cf86, Kernel Git Commit 033bc80, and Kernel Git Commit 6343c1d for the fix commits across stable kernel branches. Consume distribution-provided kernel updates once they include these commits.
Workarounds
- Block outbound TCP/445 at the network perimeter to prevent Linux clients from reaching attacker-controlled SMB servers.
- Disable or blacklist the cifs kernel module on hosts that do not require SMB client functionality using modprobe.d configuration.
- Where SMB is required, enforce SMB signing and mount only from authenticated, trusted internal servers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.