{"id":"CVE-2026-89633","state":"PUBLISHED","title":"smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()\n\ncoalesce_t2() computes data pointers directly from server-supplied\nDataOffset fields with no validation against buffer bounds:\n\n  data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +\n                     get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);\n  data_area_of_src = (char *)&pSMBs->hdr.Protocol +\n                     get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);\n  data_area_of_tgt += total_in_tgt;\n  ...\n  memcpy(data_area_of_tgt, data_area_of_src, total_in_src);\n\nA small DataOffset can push a pointer below the actual byte area,\noverwriting header fields; a large one can push it past the buffer\nend, causing out-of-bounds heap reads (source) or writes (target).\nThe BCC overflow guard does not prevent this: BCC reflects how much\ndata is present, while DataOffset controls where in the buffer it\nstarts.\n\nThe \"validate target area\" comment present since the function was\nfirst written in 2005 was a placeholder that was never implemented.\n\nAdd lower- and upper-bound checks for both data pointers before the\nmemcpy, and before any target header fields are modified.","publishedAt":"2026-09-11T19:45:28.083Z","updatedAt":"2026-10-30T12:32:22.744Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"f7baf60435129e3a5f3500a38e3cb4c3860deed7","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"9f3a7440731a34c89ad04fef6616f185acb28401","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"531ac35abd74fb5b4aec5e19543e832613a1789d","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"6eb70b78e48b0031bd1a05fe1b58959a48e87739","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"36d01415d881d5326a0dd3384f781cd7e69aff2d","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"033bc80019f07d158630df4e69b19a49010f54f1","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"6343c1da561962688f203362d80d6a3bfa39fa1b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb1transport.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.12","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb1transport.c"]}],"references":["https://git.kernel.org/stable/c/f7baf60435129e3a5f3500a38e3cb4c3860deed7","https://git.kernel.org/stable/c/9f3a7440731a34c89ad04fef6616f185acb28401","https://git.kernel.org/stable/c/531ac35abd74fb5b4aec5e19543e832613a1789d","https://git.kernel.org/stable/c/6eb70b78e48b0031bd1a05fe1b58959a48e87739","https://git.kernel.org/stable/c/36d01415d881d5326a0dd3384f781cd7e69aff2d","https://git.kernel.org/stable/c/672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e","https://git.kernel.org/stable/c/033bc80019f07d158630df4e69b19a49010f54f1","https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"],"weaknesses":[],"ingestedAt":"2026-10-30T12:50:04.827Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/89xxx/CVE-2026-89633.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-89633","state":"PUBLISHED","datePublished":"2026-09-11T19:45:28.083Z","dateUpdated":"2026-10-30T12:32:22.744Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-11T19:38:34.739Z"},"containers":{"cna":{"title":"smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()\n\ncoalesce_t2() computes data pointers directly from server-supplied\nDataOffset fields with no validation against buffer bounds:\n\n  data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +\n                     get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);\n  data_area_of_src = (char *)&pSMBs->hdr.Protocol +\n                     get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);\n  data_area_of_tgt += total_in_tgt;\n  ...\n  memcpy(data_area_of_tgt, data_area_of_src, total_in_src);\n\nA small DataOffset can push a pointer below the actual byte area,\noverwriting header fields; a large one can push it past the buffer\nend, causing out-of-bounds heap reads (source) or writes (target).\nThe BCC overflow guard does not prevent this: BCC reflects how much\ndata is present, while DataOffset controls where in the buffer it\nstarts.\n\nThe \"validate target area\" comment present since the function was\nfirst written in 2005 was a placeholder that was never implemented.\n\nAdd lower- and upper-bound checks for both data pointers before the\nmemcpy, and before any target header fields are modified."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"f7baf60435129e3a5f3500a38e3cb4c3860deed7","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"9f3a7440731a34c89ad04fef6616f185acb28401","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"531ac35abd74fb5b4aec5e19543e832613a1789d","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"6eb70b78e48b0031bd1a05fe1b58959a48e87739","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"36d01415d881d5326a0dd3384f781cd7e69aff2d","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"033bc80019f07d158630df4e69b19a49010f54f1","versionType":"git"},{"version":"e4eb295d38b57f4d4b956942a48887eb252d97c6","status":"affected","lessThan":"6343c1da561962688f203362d80d6a3bfa39fa1b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb1transport.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.12","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.113","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.51","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/client/smb1transport.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f7baf60435129e3a5f3500a38e3cb4c3860deed7"},{"url":"https://git.kernel.org/stable/c/9f3a7440731a34c89ad04fef6616f185acb28401"},{"url":"https://git.kernel.org/stable/c/531ac35abd74fb5b4aec5e19543e832613a1789d"},{"url":"https://git.kernel.org/stable/c/6eb70b78e48b0031bd1a05fe1b58959a48e87739"},{"url":"https://git.kernel.org/stable/c/36d01415d881d5326a0dd3384f781cd7e69aff2d"},{"url":"https://git.kernel.org/stable/c/672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e"},{"url":"https://git.kernel.org/stable/c/033bc80019f07d158630df4e69b19a49010f54f1"},{"url":"https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - coalesce_t2() runs in cifs_demultiplex_thread on SMB1 TRANS2 responses received over TCP/445; a malicious or compromised SMB1 server (or MITM on an unsigned session) delivers the crafted DataOffset/DataCount fields entirely over the network.\nAC:L - The server fully controls DataOffset, DataCount, and TotalDataCount in both primary and secondary TRANS2 PDUs and can force a large first fragment so mid->resp_buf is set; the unbounded memcpy is deterministic with no race or condition outside the attacker’s control.\nPR:N - The attacker is the remote SMB peer and needs no account or privileges on the victim; coalesce_t2() runs in the demux thread before validate_t2() or any local capability check, and session credentials belong to the client mount, not the attacking server.\nUI:N - Once an SMB1 CIFS mount exists (fstab, autofs, embedded/industrial NAS; CONFIG_CIFS_ALLOW_INSECURE_LEGACY defaults on), reconnect and ordinary lookup/readdir/getattr plus cifs_qfs_tcon QUERY_FS_INFO issue TRANS2 automatically, so the server can trigger coalescing with no further user action.\nS:U - The out-of-bounds heap read/write corrupts the client kernel’s own cifs_request slab within the same host security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - An unvalidated source DataOffset lets memcpy read far past the secondary response (DataOffset is a 16-bit value up to 65535 versus a ~16KB cifs_request object), disclosing adjacent kernel heap; the same memory-corruption primitive can be leveraged for further disclosure.\nI:H - An unvalidated target DataOffset lets memcpy write attacker-controlled bytes past the primary buffer (or backward into the SMB header); the BCC-size guard does not constrain where the copy starts, yielding an out-of-bounds write exploitable for control-flow hijacking.\nA:H - Reading or writing tens of kilobytes past the cifs_request allocation can fault on unmapped pages and oops or panic the demux thread, and a malicious server can retrigger it on every multi-part TRANS2."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:32:22.744Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18.51"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}