Cloudanix VulnDB

CVE-2026-89631

Critical · 9.1

CVSS

9.1

EPSS

0.5%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how Linux systems talk to file servers can let a malicious server steal pieces of the computer's memory and show them to regular users.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in SMB client tree connect response parser allows up to 65535 bytes to be copied from a ~16 KB slab object into userspace via tcon->nativeFileSystem when ByteCount is 0 or 1.

Why it matters to the business

Organizations running Linux SMB clients face information disclosure risk from untrusted servers, potentially exposing kernel memory contents in debug interfaces after 43 days of public availability with slowly rising exploit probability.

How an attack unfolds

An attacker operating a malicious SMB server returns a tree connect response with ByteCount 0 or 1; the client's CIFSTCon parser miscalculates bounds, performs an oversized read from the cifs request pool, and exposes the resulting data through /proc/fs/cifs/DebugData.

How to fix it

Apply the upstream kernel patch that rejects tree connect responses with ByteCount smaller than two bytes; rebuild and deploy the updated kernel across all affected Linux systems.

How to confirm the fix worked

Confirm the patch is present by checking for the new rejection logic and trace point in the SMB client code; verify that responses with ByteCount less than 2 are dropped before parsing.

Typical attack path

  1. Attacker positions themselves as an SMB server reachable by the victim client
  2. Client initiates tree connect to attacker-controlled share
  3. Server replies with crafted response containing ByteCount of 0 or 1
  4. Client parser computes oversized size_t bound and performs out-of-bounds read
  5. Leaked kernel memory is written to tcon->nativeFileSystem and becomes visible in /proc

How to detect it

Inspect /proc/fs/cifs/DebugData for unexpected or oversized nativeFileSystem strings after SMB sessions; review kernel logs for new smb_eio_trace entries related to tree connect responses.

What your security team should do

  • Prioritize kernel updates on all systems acting as SMB clients within the next patch cycle
  • Monitor EPSS trend and re-evaluate if exploit code appears given the 9.1 CVSS and network attack vector
  • Restrict SMB client connections to trusted servers only until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData. Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.

Affected packages

Ecosystem Package Introduced Fixed