CVE-2026-89631

The Linux kernel's SMB client fails to validate the byte-count field of a server's TREE_CONNECT response: when a server replies with ByteCount 0 or 1, an integer underflow turns the parser's remaining-length bound into up to 65535 bytes, so cifs_strndup_from_utf16() reads past the end of a ~16 KB slab-allocated request buffer. Any Linux host that performs an SMB/CIFS mount against a malicious server — or whose unencrypted server responses are tampered with by a man-in-the-middle — can be triggered with a single malformed reply, requiring no authentication beyond the client initiating the mount. The out-of-bounds kernel bytes are copied into tcon->nativeFileSystem and reach userspace through /proc/fs/cifs/DebugData (information disclosure), and the overread can also crash the client (denial of service), consistent with the 9.1 CVSS rating's high confidentiality and availability impact. The fix rejects any response whose byte area is too small for the parser to consume; no public proof of concept or in-the-wild exploitation is currently known.

What to do: Apply distribution kernel updates as soon as the fix reaches stable releases; the patch simply rejects tree-connect responses with byte counts too small for the parser. Until patched, avoid mounting SMB shares from untrusted or unverified servers and enforce SMB3 with signing/encryption (e.g., vers=3.x with seal) so a man-in-the-middle cannot forge the malformed response. Watch for kernel oopses in CIFSTCon and restrict access to /proc/fs/cifs/DebugData, which is the path by which the leaked kernel bytes are disclosed.