CVE-2026-89633
Critical · 9.8CVSS
9.8
EPSS
0.5%
Published
Sep 11, 2026
CISA due date
—
Cloudanix analysis
A bug in how Linux handles network file shares lets attackers who control a file server take over computers that connect to it.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Unvalidated server-supplied DataOffset values in coalesce_t2() allow computation of pointers outside the allocated SMB buffer, enabling memcpy operations that perform out-of-bounds reads from the source and writes into the target, including potential overwrite of protocol header fields.
Why it matters to the business
Remote unauthenticated attackers can achieve arbitrary memory corruption on Linux systems using the SMB client, risking full system compromise, data exfiltration, or denial of service when connecting to attacker-controlled servers.
How an attack unfolds
An attacker-controlled SMB server returns a specially crafted Trans2 response containing a DataOffset value that, when processed by coalesce_t2(), produces pointers below the buffer start or beyond its end; the subsequent memcpy then corrupts adjacent memory, enabling information disclosure or code execution.
How to fix it
Apply the upstream Linux kernel patch that adds lower- and upper-bound validation on both data pointers before any header modification or memcpy in coalesce_t2(); rebuild and deploy the fixed kernel across all affected systems.
How to confirm the fix worked
Confirm the presence of the bound-check logic in the kernel source (search for the added validation before memcpy in coalesce_t2) or verify the running kernel is newer than the commit that resolved the issue.
Typical attack path
- Establish an SMB session from a vulnerable Linux client to an attacker-controlled server
- Send a Trans2 response with a malicious DataOffset value
- Trigger coalesce_t2() during response coalescing
- Perform out-of-bounds read or write via unchecked memcpy
- Leverage memory corruption for privilege escalation or remote code execution
How to detect it
Inspect kernel logs and crash dumps for faults in the cifs or smbfs modules during SMB transaction processing; correlate with inbound SMB responses containing unusual DataOffset values if packet captures are available.
What your security team should do
- Prioritize kernel updates on all systems that mount SMB shares
- Temporarily disable SMB client functionality or restrict outbound SMB connections where feasible until patched
- Monitor kernel logs for oops or panic messages originating from cifs or smbfs modules
The record
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); data_area_of_tgt += total_in_tgt; ... memcpy(data_area_of_tgt, data_area_of_src, total_in_src); A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target). The BCC overflow guard does not prevent this: BCC reflects how much data is present, while DataOffset controls where in the buffer it starts. The "validate target area" comment present since the function was first written in 2005 was a placeholder that was never implemented. Add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|