CVE-2026-89637
massUse-After-Free in Linux Kernel SMB Client via Malformed Secondary TRANSACT2 Responses
CVE-2026-89637 is a use-after-free and buffer leak in the Linux kernel's SMB/CIFS client, specifically in cifs_check_trans2() when handling malformed secondary TRANSACT2 (T2) responses. When a client with an active CIFS mount receives a valid primary response followed by an invalid secondary response, the error path overwrites the primary response buffer and leaves a dangling pointer to server->smallbuf or server->bigbuf, which the demultiplex thread then reuses for the next packet, corrupting freed kernel memory. Exploitation requires the victim's kernel to process SMB responses from a malicious or compromised SMB server (or an on-path attacker on unencrypted connections), but needs no authentication or user interaction beyond an existing mount, and successful exploitation of the memory corruption could yield kernel-level code execution or a crash (CVSS 9.8, C:H/I:H/A:H). Any Linux system running a kernel with the vulnerable cifs_check_trans2() code path and using CIFS/SMB mounts is affected; specific fixed kernel versions are not stated in the advisory data. No public proof-of-concept exists and the flaw is not listed in CISA's KEV, so exploitation status is none known.
What to do: Apply kernel updates from your distribution as soon as backported fixes containing this cifs_check_trans2() correction are released, and reboot to load the patched kernel. In the interim, avoid mounting CIFS/SMB shares from untrusted or semi-trusted servers, restrict outbound SMB (TCP 445) to known-good servers at the network layer, and prefer SMB3 with encryption/signing to close on-path attack vectors. Audit systems for automount or fstab entries that connect to externally controlled SMB servers, since those represent the highest-risk exposure.
| Linux kernel (SMB/CIFS client, fs/smb/client) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free. Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeue_mid() with malformed=true, and return true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news0 stories
No ingested article mentions this CVE yet.