CVE-2026-89634: Linux Kernel SMB Client Buffer Overflow

CVE-2026-89634 Overview

CVE-2026-89634 is an integer overflow vulnerability in the Linux kernel's SMB client code. The flaw resides in the symlink_data() error context loop within the smb/client subsystem. A previous fix (commit 7d9a7f1f96cd) added a bounds check against a post-ALIGN() length, but the ALIGN() macro itself can overflow when ErrorDataLength approaches UINT32_MAX. For values such as 0xFFFFFFF9, ALIGN(x, 8) wraps to zero, causing the subsequent bounds check to pass while the loop advances by zero bytes. The pointer p then references stale data, enabling out-of-bounds reads over the network from a malicious SMB server.

Critical Impact
A crafted SMB response with an ErrorDataLength field near UINT32_MAX can trigger an integer overflow in the kernel SMB client, resulting in out-of-bounds reads and potential kernel denial of service.

Affected Products

Linux Kernel smb/client subsystem (versions containing commit 7d9a7f1f96cd prior to the fix)
Distributions shipping affected stable kernel branches referenced in the patch commits
Systems mounting remote SMB/CIFS shares with symlink handling enabled

Discovery Timeline

2026-09-11 - CVE-2026-89634 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89634

Vulnerability Analysis

The vulnerability exists in the symlink_data() function of the Linux kernel SMB client. When parsing SMB error responses that carry symlink context data, the client iterates through error context entries whose sizes are described by the ErrorDataLength field. The prior hardening commit compared the aligned length against the remaining buffer, but did not account for arithmetic overflow inside the ALIGN() macro itself.

When ErrorDataLength holds a value near UINT32_MAX, the expression ALIGN(x, 8) wraps around to zero. The bounds check then trivially succeeds because zero is less than the remaining buffer size. The loop advances the parsing pointer by zero bytes on each iteration, either producing an infinite loop or leaving p pointing to attacker-influenced stale memory that the code subsequently dereferences.

Root Cause

The root cause is an unchecked integer overflow in a size-alignment computation used inside a bounds check. ALIGN(x, 8) computes (x + 7) & ~7. When x exceeds UINT32_MAX - 7, the addition wraps within 32-bit arithmetic and the result is truncated, defeating the guard. This is a classic pre-check overflow pattern where the sanitized value used for comparison is derived from attacker-controlled input without validating the raw value first.

Attack Vector

A remote SMB server, or an attacker capable of intercepting and modifying SMB traffic, can send a response containing a crafted ErrorDataLength value. Because the attack is delivered over the network with no privileges or user interaction required, any Linux client that mounts an untrusted SMB share is exposed. Successful exploitation yields out-of-bounds reads inside the kernel and can crash the host, leading to denial of service. The fix, described in the patch series, validates the raw ErrorDataLength against the remaining buffer space before applying ALIGN(), then reapplies the alignment guard afterward so that raw_len + 7 cannot overflow.

Detection Methods for CVE-2026-89634

Indicators of Compromise

Unexpected kernel oops, panic, or KASAN reports referencing symlink_data or the SMB client parsing path
SMB sessions to untrusted or unknown remote servers followed by kernel instability
Repeated client-side disconnects from SMB mounts accompanied by error context parsing warnings in dmesg

Detection Strategies

Inventory Linux endpoints and servers mounting SMB/CIFS shares and cross-reference running kernel versions against the fixed stable branches
Monitor kernel logs for warnings, BUG:, or WARNING: traces originating in fs/smb/client/
Inspect SMB traffic for anomalous ErrorDataLength values approaching UINT32_MAX in error response packets

Monitoring Recommendations

Forward kernel and audit logs to a centralized analytics pipeline and alert on SMB client crash signatures
Track outbound SMB connections from Linux hosts to non-corporate destinations
Alert on repeated kernel module faults tied to cifs.ko or smb.ko across the fleet

How to Mitigate CVE-2026-89634

Immediate Actions Required

Apply the stable kernel updates that include the fix commits referenced by the upstream advisory
Restrict Linux clients to mounting SMB shares only from trusted, authenticated servers
Where patching is delayed, unmount and disable SMB client access to untrusted networks

Patch Information

The fix validates the raw ErrorDataLength against the remaining buffer before applying ALIGN(), then performs an exact post-alignment bounds check. Corrected code is available in the following upstream commits: Kernel Git Commit 1f824f6, Kernel Git Commit 2b4a25b, Kernel Git Commit 62656b0, Kernel Git Commit 62a3025, Kernel Git Commit 657372b, and Kernel Git Commit b89d678.

Workarounds

Block outbound SMB (TCP/445) from Linux clients to untrusted networks at the perimeter firewall
Disable automatic SMB mounts in /etc/fstab for shares hosted outside the trust boundary
Enforce SMB signing and require authenticated servers to reduce exposure to hostile responses

bash

# Example: block outbound SMB to untrusted networks with nftables
nft add rule inet filter output tcp dport 445 ip daddr != 10.0.0.0/8 drop