CVE-2026-89794: Linux Kernel ksmbd Information Disclosure

CVE-2026-89794 Overview

CVE-2026-89794 is an information disclosure vulnerability in the Linux kernel's ksmbd in-kernel SMB3 server. The flaw exists in smb2_read_pipe(), which allocates only the payload size when handling compound responses. Because compound response handling extends the last response iov to an eight-byte boundary, the alignment padding can expose up to seven bytes of uninitialized kernel heap memory to a remote SMB client. The issue has been resolved by allocating the aligned size and clearing the unused tail before pinning the response buffer.

Critical Impact
Remote SMB clients can retrieve small fragments of uninitialized kernel heap memory, potentially leaking pointers or secrets useful for further exploitation.

Affected Products

Linux kernel ksmbd SMB server component
Kernel branches receiving the fixes in commits 73f8604, be15b8d, d83a9de, and f188a40
Systems exposing ksmbd named pipe (IPC$) services to network clients

Discovery Timeline

2026-09-16 - CVE-2026-89794 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89794

Vulnerability Analysis

The ksmbd server implements SMB2 compound request handling, where multiple SMB commands can be chained in a single network transaction. During response construction, the kernel pads the last response iov up to an eight-byte boundary to satisfy SMB2 alignment requirements.

The function smb2_read_pipe() handles reads from SMB named pipes such as those used by DCE/RPC transports. It allocated a buffer sized only to the pipe payload length. When the response was subsequently padded to the eight-byte boundary, the padding bytes lay outside the initialized region of the allocation and were transmitted to the remote client unchanged. This is classified as Uninitialized Memory Use and Information Disclosure [CWE-908].

Because the leaked bytes come from freshly allocated kernel heap, they may contain residual data from prior allocations, including pointers useful for defeating Kernel Address Space Layout Randomization (KASLR).

Root Cause

The allocation size in smb2_read_pipe() did not account for the eight-byte alignment padding applied by the compound response path. Up to seven trailing bytes of the response buffer were never written by the pipe read logic and were never zeroed before being pinned into the response iov.

Attack Vector

An authenticated SMB client connecting to a ksmbd share can issue a compound request that includes a small pipe read. The server returns a response whose padding bytes contain uninitialized heap contents. Repeated requests allow the client to sample additional kernel memory. Exploitation requires network reachability to the SMB service and valid credentials for ksmbd session establishment.

See the upstream fixes in Kernel Git Commit 73f8604, Kernel Git Commit be15b8d, Kernel Git Commit d83a9de, and Kernel Git Commit f188a40.

Detection Methods for CVE-2026-89794

Indicators of Compromise

SMB2 compound requests targeting the IPC$ share and containing small pipe read operations issued in rapid succession from a single client.
Anomalous volume of SMB2 READ responses from ksmbd services where the payload size is smaller than eight bytes.
Unexpected ksmbd.mountd or kernel ksmbd worker activity on hosts not intended to serve SMB clients.

Detection Strategies

Inspect SMB2 traffic on TCP port 445 for compound READ requests against named pipes combined with other short operations, which is the pattern required to trigger the padding path.
Correlate authentication events for ksmbd sessions with subsequent bursts of small pipe reads originating from the same source.
Track kernel version and ksmbd module status across the fleet to identify unpatched hosts exposing SMB services.

Monitoring Recommendations

Log and alert on new external or lateral SMB connections to Linux hosts running ksmbd.
Baseline normal SMB pipe usage per client and flag deviations, especially high-frequency short reads.
Monitor kernel logs for ksmbd errors or unusual session churn that may accompany probing activity.

How to Mitigate CVE-2026-89794

Immediate Actions Required

Apply the upstream kernel updates that include commits 73f8604, be15b8d, d83a9de, and f188a40 to eligible stable branches.
Restrict access to ksmbd services with host firewalls, limiting TCP 445 to trusted management networks and known SMB clients.
Enforce strong authentication on ksmbd shares and disable guest access to reduce the pool of clients capable of triggering the flaw.

Patch Information

The fix modifies smb2_read_pipe() to allocate the aligned response size and zero the trailing padding bytes before the buffer is pinned into the compound response. Distribution kernels rebased on the referenced stable commits contain the correction. Administrators should confirm their running kernel matches or supersedes the patched version distributed by their vendor.

Workarounds

Disable the ksmbd kernel module on hosts that do not require in-kernel SMB serving, and use user-space Samba instead where feasible.
Block inbound SMB traffic at the network perimeter and segment SMB-serving Linux hosts from untrusted clients.
Require SMB3 signing and encryption to increase the operational cost of large-scale sampling attacks against the padding leak.

bash

# Configuration example
# Temporarily unload ksmbd where the service is not required
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd

# Restrict SMB access to a trusted management subnet
sudo iptables -A INPUT -p tcp --dport 445 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP