CVE-2026-89633

The Linux kernel's SMB/CIFS client contains a critical (CVSS 9.8) out-of-bounds read and write flaw in coalesce_t2(), which merges multi-part TRANS2 responses. The function computes source and destination data pointers directly from server-supplied DataOffset fields without checking them against buffer bounds, so a malicious SMB server can craft a response whose DataOffset points below the data area (overwriting SMB header fields) or past the end of the heap buffer (out-of-bounds reads from the source or writes to the target). An attacker controlling or spoofing an SMB server gains kernel memory corruption on any client that mounts from it, plausibly enabling a kernel crash (denial of service) or privilege escalation to ring 0 on the mounting machine. Any Linux system with the CIFS client code — present since the function was introduced in 2005 — is affected whenever it mounts an SMB share from an untrusted or compromised server. No public PoC exists, the flaw is not in CISA's KEV, and no exploitation has been observed.

What to do: Apply kernel updates containing the coalesce_t2() bounds-check fix as soon as your distribution ships it, prioritizing systems that regularly mount SMB/CIFS shares. As mitigation, only mount shares from trusted servers over authenticated, encrypted connections (avoid guest/unauthenticated mounts and untrusted networks where spoofing is possible), and consider disabling the legacy SMB1 dialect on client mounts since the vulnerable path handles SMB1 TRANS2 responses. Check whether hosts in your environment auto-mount or browse SMB shares (e.g., file managers, automount maps, NAS clients) and treat any that mount from untrusted sources as potentially compromised.