Cloudanix VulnDB

CVE-2026-89637

Critical · 9.8

CVSS

9.8

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how Linux handles certain network file-sharing replies can let attackers crash systems or take them over if they can send crafted responses during file operations.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in the Linux kernel SMB client when a valid primary TRANSACT2 response is followed by a malformed secondary response, causing handle_mid() to overwrite mid->resp_buf without clearing server->smallbuf/bigbuf pointers, leaving dangling references that the demux thread reuses.

Why it matters to the business

Remote attackers can trigger kernel memory corruption on Linux systems acting as SMB clients, potentially leading to system crashes, data exposure, or full host compromise with high urgency due to the 43-day publication window and stable EPSS score.

How an attack unfolds

An attacker positioned to respond to SMB requests sends a valid primary TRANSACT2 followed by a secondary PDU that fails header validation or check2ndT2(), forcing the client into the UAF path where the demux thread reuses freed buffers for subsequent packets.

How to fix it

Apply the upstream kernel patch that combines early-exit conditions, sets multiEnd, and calls dequeue_mid with malformed=true when multiRsp is already set; rebuild and deploy updated kernel packages across all affected distributions.

How to confirm the fix worked

Confirm kernel source contains the combined early-exit logic in cifs_check_trans2 and that mid->resp_buf and server buffer pointers are no longer overwritten on malformed secondary T2 when multiRsp is true; test with synthetic malformed T2 sequences.

Typical attack path

  1. Establish SMB session as server to Linux client
  2. Send valid primary TRANSACT2 response setting multiRsp
  3. Send malformed secondary T2 response triggering early exit in cifs_check_trans2
  4. Trigger user thread free of mid->resp_buf while demux reuses dangling server buffer pointers
  5. Reuse freed memory for arbitrary kernel read/write or code execution

How to detect it

Review kernel logs for SMB client crashes or oops involving cifs_check_trans2 or handle_mid; inspect network captures for TRANSACT2 responses with malformed headers following valid primary responses; correlate with processes using the CIFS module.

What your security team should do

  • Prioritize kernel updates on all Linux SMB clients within the next maintenance window
  • Monitor for SMB traffic anomalies on ports 445 and 139
  • Restrict SMB client connections to trusted servers until patched
  • Review EPSS stability and absence from KEV for risk acceptance decisions

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free. Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeue_mid() with malformed=true, and return true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.

Affected packages

Ecosystem Package Introduced Fixed