CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

EUVD-2026-76543

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631

CVE-2026-89631 affects the Linux kernel SMB (CIFS) client . In CIFSTCon(), the strnlen() bound over the byte area uses the server's ByteCount minus two; when ByteCount is 0 or 1, the value underflows to a huge size_t, causing cifs_strndup_from_utf16() to read up to 65,535 bytes past the ~16 KB sl...

CVE-2026-89630

CVE-2026-89630 is a critical vulnerability in the Linux kernel's CIFS/SMB client . A regression introduced by commit 83bfbd0bb902 (which removed the RFC1002 header from smb_hdr) caused the data_offset bound check in is_valid_oplock_break() to evaluate to zero, effectively disabling the overflow g...

CVE-2026-89630 smb: client: restore the data_offset bound in is_valid_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

CVE-2026-89630 smb: client: restore the data_offset bound in is_valid_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

PT-2026-90349

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the coalesce t2 function computes data pointers using server-supplied DataOffset fields without validating them against buffer bounds. A small...

PT-2026-96560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse buf ptr reparse buf ptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparse data buffer u8 io + off; len =...

PT-2026-96465

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce-tgthint in free tgts When free tgts frees all structures in ce-tlist, ce-tgthint is left pointing to one of the freed cache dfs tgt structures. If ce-tgthint is not reset before it is used later, it results ...

CVE-2026-89631: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

PT-2026-90347

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the CIFSTCon function incorrectly handles tree connect responses with a ByteCount of 0 or 1. In these cases, the calculation of the byte area...

PT-2026-90348

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the reparse buf ptr function reads the ReparseDataLength variable before verifying that the count covers the full fixed header. If a server return...

CVE-2026-89633: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2 coalescet2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: dataareaoftgt = char...

CVE-2026-89634: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlinkdata error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlinkdata" compared the post-ALIGN length against the remaining...

PT-2026-96517

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlink data error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlink data" compared the post-ALIGN length against the remaining...

PT-2026-90350

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer overflow exists in the SMB client within the symlink data function. The issue occurs when the ALIGN macro is used to process ErrorDataLength. If ErrorDataLength is near UINT32...

PT-2026-90352

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the SMB client. When the free tgts function frees all structures within ce-tlist, the ce-tgthint variable continues to point to one of the freed cache df...

CVE-2026-89636: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce-tgthint in freetgts When freetgts frees all structures in ce-tlist, ce-tgthint is left pointing to one of the freed cachedfstgt structures. If ce-tgthint is not reset before it is used later, it results in a...

PT-2026-90346

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client where the data offset bound in the is valid oplock break function was incorrectly calculated. A change intended to remove the RFC1002 header from smb hd...