CVE-2026-89632

The Linux kernel's SMB/CIFS client code contains a use-before-check flaw in reparse_buf_ptr(): it reads the 2-byte ReparseDataLength field at offset 4 of a reparse point buffer before verifying that the response is even large enough to contain the 8-byte fixed header. A malicious or compromised SMB server can return a deliberately truncated reparse point response (for example when the client follows a symlink or other reparse tag on the share) and cause the kernel to read past the end of the allocated buffer. The result is primarily denial of service via a kernel fault or panic, with possible limited disclosure of adjacent kernel memory, consistent with the CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N, A:H, C:L). Any Linux system whose kernel includes the affected fs/smb/client code and which mounts SMB shares — especially from untrusted servers — is potentially affected; the advisory does not specify fixed version numbers, so check your distribution's kernel packages. No public proof of concept is known and the issue is not on CISA's KEV, so exploitation is not known to be occurring in the wild.

What to do: Update to a kernel containing the reparse_buf_ptr() fix as soon as your distribution ships it in stable or LTS kernel packages. In the interim, avoid mounting SMB/CIFS shares from untrusted or unauthenticated servers and disable automounting of network shares. Monitor kernel logs for cifs/smb-client oopses or panics on machines that mount external shares, which would indicate malformed reparse responses.