CVE-2026-89634

CVE-2026-89634 is an integer-overflow flaw in the Linux kernel's SMB/CIFS client, in the symlink_data() error-context parsing loop. When a client mounts an SMB share and parses a symlink reparse point, a malicious or compromised SMB server can supply an ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9); ALIGN() then wraps to 0, defeating the bounds check so the loop advances zero bytes and reads stale/out-of-bounds buffer data. An attacker controlling an SMB server that a victim mounts gains disclosure of kernel memory (CVSS confidentiality: high) and can hang or crash the client (availability: high) with no privileges or user interaction required. The bug also undermines the earlier fix in commit 7d9a7f1f96cd, so kernels carrying that incomplete patch remain vulnerable. There is no public PoC, it is not in CISA KEV, and no exploitation is known to date.

What to do: Apply a kernel update containing the fix (verify your distro's kernel includes the corrected bounds check in symlink_data()) and reboot to load it. Until patched, restrict or avoid mounting SMB shares from untrusted or external servers, review automount/NAS configurations that connect to semi-trusted shares, and monitor for hung cifs mount processes or unexpected client crashes as indicators.