CVE-2026-89637 Overview
CVE-2026-89637 is a use-after-free (UAF) and buffer leak vulnerability in the Linux kernel's SMB/CIFS client. The flaw resides in cifs_check_trans2() and is triggered by malformed secondary TRANSACT2 (T2) responses. When a valid primary T2 response has been received and a subsequent secondary response fails validation, handle_mid() overwrites mid->resp_buf with the new buffer and skips the server buffer NULL-out. After the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling, and the demux thread reuses the freed memory for the next packet.
Critical Impact
A malicious or compromised SMB server can trigger kernel memory corruption on connected Linux clients, enabling potential remote code execution in kernel context.
Affected Products
- Linux kernel SMB/CIFS client (fs/smb/client)
- Linux distributions shipping affected kernel versions
- Systems mounting remote SMB/CIFS shares
Discovery Timeline
- 2026-09-11 - CVE-2026-89637 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89637
Vulnerability Analysis
The vulnerability affects the CIFS client code path that handles multi-response TRANSACT2 operations. TRANSACT2 (T2) operations in the SMB1 protocol allow responses to be split across multiple PDUs, with a primary response followed by one or more secondary responses. The kernel tracks these using the mid (multiplex ID) structure, with mid->resp_buf holding the buffered response and mid->multiRsp indicating multi-response state.
When cifs_check_trans2() receives a secondary response after a valid primary, it validates the SMB header and calls check2ndT2() to verify the PDU. If either check fails, the function returns false. The caller handle_mid() then overwrites mid->resp_buf with the newly received buffer, leaking the previously stored primary buffer. Critically, because mid->multiRsp remains set, handle_mid() skips the code path that NULLs out server->smallbuf or server->bigbuf, leaving stale pointers to the same memory.
Root Cause
The root cause is an inconsistent state transition when secondary T2 responses are malformed. The buffer ownership tracking assumes that if multiRsp is set, the server buffer pointers were already transferred and cleared. When early-exit conditions fire without properly aborting the transaction, both the user thread (which frees mid->resp_buf) and the demux thread (which reuses server->smallbuf/server->bigbuf) hold references to the same freed allocation.
Attack Vector
An attacker controlling an SMB server, or a network-position attacker capable of injecting SMB responses, can send a malformed secondary TRANSACT2 PDU after a valid primary response. The malformed PDU triggers the early-exit path in cifs_check_trans2(), producing the dangling pointer. Subsequent packet handling by the demux thread reuses the freed memory, causing memory corruption exploitable for privilege escalation or kernel-mode code execution.
No authenticated user interaction is required on the client beyond having an established SMB session with the malicious server. The patch combines both early-exit conditions and, when mid->multiRsp is already set, aborts the pending transaction inline by setting multiEnd, calling dequeue_mid() with malformed=true, and returning true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.
Detection Methods for CVE-2026-89637
Indicators of Compromise
- Kernel panics or oops messages referencing cifs_check_trans2, handle_mid, or cifs_demultiplex_thread
- KASAN reports indicating use-after-free in the SMB client code path
- Unexpected disconnections from SMB shares followed by kernel instability
- Malformed SMB1 TRANSACT2 secondary response PDUs in network capture
Detection Strategies
- Monitor kernel ring buffer (dmesg) for CIFS-related crashes or memory corruption warnings
- Deploy network intrusion detection signatures for anomalous SMB1 TRANSACT2 secondary response patterns
- Enable KASAN in test environments to surface UAF conditions during SMB workload testing
- Audit systems for outbound SMB connections to untrusted or unknown servers
Monitoring Recommendations
- Log all SMB/CIFS mount operations and the remote server addresses involved
- Alert on kernel crash dumps that reference fs/smb/client symbols
- Track EDR telemetry for unexpected kernel-mode process activity following SMB session establishment
- Correlate network flows to SMB servers with kernel stability events on client hosts
How to Mitigate CVE-2026-89637
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel commit 5e6533a683, kernel commit 730d0bb195, and kernel commit 9eed72e953
- Restrict outbound SMB connections to trusted internal file servers only
- Prefer SMB3 over SMB1 where possible, as the vulnerable T2 code path is SMB1-specific
- Prioritize patching of Linux hosts that mount third-party or internet-reachable SMB shares
Patch Information
The fix is applied in the Linux kernel's fs/smb/client subsystem. It combines both early-exit conditions in cifs_check_trans2() and, when mid->multiRsp is set, aborts the transaction inline by setting multiEnd, calling dequeue_mid() with malformed=true, and returning true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers. Distribution vendors should backport the referenced stable commits to supported kernel branches.
Workarounds
- Disable SMB1 protocol support in the kernel using vers=3.0 or higher on mount.cifs invocations
- Block outbound TCP/445 traffic to untrusted networks at the perimeter firewall
- Unmount CIFS shares from hosts that cannot be immediately patched if the risk warrants it
# Force SMB3 and disable legacy SMB1 protocol on mount
mount -t cifs //server/share /mnt/share \
-o vers=3.0,sec=krb5,username=user
# Block outbound SMB to untrusted networks
iptables -A OUTPUT -p tcp --dport 445 -d <untrusted_range> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
