CVE-2026-89632

What it actually does

The smb client reparse_buf_ptr() function reads buf->ReparseDataLength at offset 4 before validating that the received count covers at least sizeof(struct reparse_data_buffer), allowing an out-of-bounds read when a server supplies OutputCount smaller than 6 bytes.

Why it matters to the business

Systems mounting SMB shares from untrusted servers may experience kernel crashes or limited memory disclosure, disrupting file access and requiring emergency patching across fleets.

How an attack unfolds

An attacker hosts a malicious SMB server that replies to reparse-point queries with OutputCount less than the fixed header size; a vulnerable client performing directory operations triggers the premature read, resulting in an out-of-bounds access that can crash the kernel or leak adjacent memory.

How to fix it

Update the Linux kernel to a version containing the split validation check that verifies count >= sizeof(*buf) before accessing ReparseDataLength; apply the vendor-supplied patch that enforces the length check prior to the field read.

How to confirm the fix worked

Confirm the presence of the two-stage length check (count >= sizeof(struct reparse_data_buffer) followed by the data-region check) in the reparse_buf_ptr() function of the running kernel source or binary; test against a server returning OutputCount < 6.

Typical attack path

1. attacker positions a controlled SMB server on the network
2. victim client initiates a mount or directory traversal that triggers reparse handling
3. server returns a small OutputCount in the reparse response
4. client calls reparse_buf_ptr() which dereferences the undersized buffer
5. kernel performs out-of-bounds read leading to panic or information leak

How to detect it

Review kernel logs for oops or panic entries referencing reparse_buf_ptr or reparse_data_buffer during SMB operations; correlate with network traces showing SMB responses containing OutputCount values under 6 bytes to unpatched clients.

What your security team should do

• Prioritize kernel upgrades on all systems that mount SMB shares from external or untrusted servers
• Monitor EPSS trend and schedule patching within normal change windows given the increasing exploit probability
• Harden SMB client configurations to restrict connections to trusted servers until patches are deployed