Executive brief
The Linux kernel's ksmbd (SMB server) component fails to zero-initialize padding bytes when reading named pipes in compound SMB requests. When compound response handling aligns data to an eight-byte boundary, this can expose up to seven bytes of uninitialized kernel heap memory to network clients, leaking sensitive data.
Technical details
The vulnerability is a kernel heap memory information disclosure in the smb2_read_pipe() function within fs/smb/server/smb2pdu.c. When processing compound SMB read operations on named pipes, the allocation size is set to the exact payload size without accounting for eight-byte alignment padding required by the compound response handler. This means up to seven bytes of uninitialized heap memory adjacent to the allocated buffer are included in the response sent over the network. The attack requires network access to an SMB server with ksmbd enabled and the ability to send crafted read compound requests on named pipes. The fix allocates the aligned size upfront and explicitly zeroes the padding region before pinning the response buffer.
Affected products
- Linux Linux kernel Versions containing the vulnerable smb2_read_pipe() function prior to fix commit 73f860489e3be2245598d1819226304fc5b87291
Timeline
- 2026-09-16: disclosed: CVE-2026-89794 published
- 2026-08-25: patched: Fix committed by Namjae Jeon
- 2026-09-11: patched: Fix backported to stable kernels