CVE-2026-89633 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users of SMB client functionality should be aware of this vulnerability and take necessary steps to mitigate it. This includes reviewing and applying patches, restricting access to SMB shares, monitoring SMB client activity, and implementing additional security measures. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize patching and mitigation efforts.

Why it matters

This vulnerability is critical due to its potential for code execution or denial of service attacks, and its exploitation could lead to elevation of privileges or unauthorized access to sensitive data.

• Potential code execution or denial of service attacks
• Elevation of privileges or unauthorized access to sensitive data
• Disruption of SMB client functionality or availability

Technical summary

The coalesce_t2() function in the Linux kernel's SMB client implementation does not properly validate the DataOffset field from the server, allowing for out-of-bounds reads and writes. This can cause memory corruption and potentially allow attackers to execute arbitrary code or cause a denial of service. The function computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds, which can lead to security vulnerabilities. To fix this vulnerability, it is recommended to add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Restrict access to SMB shares to trusted sources
• Monitor SMB client activity for suspicious behavior
• Consider implementing additional security measures such as SMB signing and encryption
• Perform vulnerability scanning and penetration testing to identify potential vulnerabilities
• Implement incident response plans in case of a security breach
• Conduct regular security audits and risk assessments

Evidence notes

The vulnerability exists in the coalesce_t2() function, which fails to validate the DataOffset field from the server, leading to potential out-of-bounds memory access. The function computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds. A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.