ZeroHour

CVE-2026-89637

mass

Use-After-Free in Linux Kernel SMB Client via Malformed Secondary TRANSACT2 Responses

CVSS 3.1
9.8 critical
EPSS
Published
()
Modified
AI analysis

CVE-2026-89637 is a use-after-free and buffer leak in the Linux kernel's SMB/CIFS client, specifically in cifs_check_trans2() when handling malformed secondary TRANSACT2 (T2) responses. When a client with an active CIFS mount receives a valid primary response followed by an invalid secondary response, the error path overwrites the primary response buffer and leaves a dangling pointer to server->smallbuf or server->bigbuf, which the demultiplex thread then reuses for the next packet, corrupting freed kernel memory. Exploitation requires the victim's kernel to process SMB responses from a malicious or compromised SMB server (or an on-path attacker on unencrypted connections), but needs no authentication or user interaction beyond an existing mount, and successful exploitation of the memory corruption could yield kernel-level code execution or a crash (CVSS 9.8, C:H/I:H/A:H). Any Linux system running a kernel with the vulnerable cifs_check_trans2() code path and using CIFS/SMB mounts is affected; specific fixed kernel versions are not stated in the advisory data. No public proof-of-concept exists and the flaw is not listed in CISA's KEV, so exploitation status is none known.

What to do: Apply kernel updates from your distribution as soon as backported fixes containing this cifs_check_trans2() correction are released, and reboot to load the patched kernel. In the interim, avoid mounting CIFS/SMB shares from untrusted or semi-trusted servers, restrict outbound SMB (TCP 445) to known-good servers at the network layer, and prefer SMB3 with encryption/signing to close on-path attack vectors. Audit systems for automount or fstab entries that connect to externally controlled SMB servers, since those represent the highest-risk exposure.

Affected
Linux kernel (SMB/CIFS client, fs/smb/client)
Estimated exposure
mass≈100M+ devices (vulnerable code present in most Linux kernel deployments; practical attack surface is the subset using CIFS/SMB mounts, plausibly in the tens… — The Linux kernel ships on the vast majority of Linux servers, desktops, and embedded systems, so the vulnerable client code is broadly distributed, but the flaw only manifests on systems that mount SMB shares and connect to untrusted or…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free. Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeue_mid() with malformed=true, and return true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.

Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the news

No ingested article mentions this CVE yet.