Executive brief
The Linux kernel's SMB client contains an integer overflow vulnerability in symlink handling that can cause the code to read beyond allocated memory buffers. An attacker exploiting this could crash the system or potentially execute code with kernel privileges when processing specially crafted SMB responses from a malicious or compromised file server.
Technical details
The vulnerability is an integer overflow in the symlink_data() function within fs/smb/client/smb2file.c. When processing SMB error response contexts, the code uses ALIGN(ErrorDataLength, 8) to round up a length value; if ErrorDataLength is near UINT32_MAX (e.g., 0xFFFFFFF9), the ALIGN macro wraps to 0, causing subsequent bounds checks to pass incorrectly. This allows the loop pointer to advance by zero bytes and remain pointing to stale/out-of-bounds data. The fix adds a pre-ALIGN bounds check on the raw ErrorDataLength before alignment is applied, followed by a post-ALIGN check to ensure proper buffer access. Network-reachable attack vector via SMB protocol; no authentication required.
Affected products
- Linux Linux kernel multiple versions (fix backported across stable branches)
Timeline
- 2026-09-11: disclosed: CVE-2026-89634 published
- 2026-09-07: patched: Upstream fix commit 1f824f61d1df52392eaf0b74dfa5659d724fde30
- 2026-09-14: patched: Stable kernel backport commit 2b4a25baa0b936fef6915c0459925077b324ecaf