Vulnerability-Lookup

CVE-2026-89637 (GCVE-0-2026-89637)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:32

Title

smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2

Summary

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free. Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeue_mid() with malformed=true, and return true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/9eed72e9534b10a6d…
https://git.kernel.org/stable/c/5e6533a683f6a8511…
https://git.kernel.org/stable/c/730d0bb19507b9e19…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 316cf94a910f6f93d43cc574359d163ccae098a3 , < 9eed72e9534b10a6d9f8f5146feff3db53aebdba (git) Affected: 316cf94a910f6f93d43cc574359d163ccae098a3 , < 5e6533a683f6a851158d9f33fb4ea8f4f25d7f84 (git) Affected: 316cf94a910f6f93d43cc574359d163ccae098a3 , < 730d0bb19507b9e19c2fe5343109ac618e2fbce5 (git)	guessed
Linux	Linux	Affected: 3.6 Unaffected: 0 , < 3.6 (semver) Unaffected: 6.18.51 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb1transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9eed72e9534b10a6d9f8f5146feff3db53aebdba",
              "status": "affected",
              "version": "316cf94a910f6f93d43cc574359d163ccae098a3",
              "versionType": "git"
            },
            {
              "lessThan": "5e6533a683f6a851158d9f33fb4ea8f4f25d7f84",
              "status": "affected",
              "version": "316cf94a910f6f93d43cc574359d163ccae098a3",
              "versionType": "git"
            },
            {
              "lessThan": "730d0bb19507b9e19c2fe5343109ac618e2fbce5",
              "status": "affected",
              "version": "316cf94a910f6f93d43cc574359d163ccae098a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb1transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2\n\nWhen a valid primary TRANSACT2 response has been received (mid-\u003eresp_buf\nset, mid-\u003emultiRsp true) and a subsequent secondary response causes\ncifs_check_trans2() to return false -- either because the SMB header is\ninvalid (malformed != 0) or because check2ndT2() rejects the PDU --\nhandle_mid() overwrites mid-\u003eresp_buf with the new buffer (leaking the\nprimary buffer) and, because mid-\u003emultiRsp is set, skips the\nserver-\u003esmallbuf/bigbuf NULL-out.  When the user thread frees\nmid-\u003eresp_buf, server-\u003esmallbuf or server-\u003ebigbuf is left dangling; the\ndemux thread reuses it for the next packet, resulting in a use-after-free.\n\nCombine both early-exit conditions and, when mid-\u003emultiRsp is already\nset, abort the pending transaction inline: set multiEnd, call\ndequeue_mid() with malformed=true, and return true so handle_mid() exits\nwithout touching mid-\u003eresp_buf or the server buffer pointers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - cifs_check_trans2() runs in cifs_demultiplex_thread on SMB1 TRANS2 responses received over TCP/445; a malicious or compromised SMB1 server (or MITM on an unsigned session) delivers the crafted primary and malformed secondary PDUs entirely over the network.\nAC:L - The attacker fully controls both fragments: a valid primary with TotalDataCount greater than DataCount sets mid-\u003emultiRsp, then a secondary with WordCount != 10, inconsistent counts, or a malformed SMB header makes cifs_check_trans2() return false. The resulting UAF is deterministic with no race outside the attacker\u0027s control.\nPR:N - The attacker is the remote SMB peer and needs no account or privileges on the victim; cifs_check_trans2() runs in the demux thread on server-supplied frames, and session credentials belong to the client mount, not the attacking server.\nUI:N - Once an SMB1 CIFS mount exists (fstab, autofs, cifsroot, embedded/industrial NAS; CONFIG_CIFS_ALLOW_INSECURE_LEGACY defaults on), reconnect and ordinary lookup/readdir/getattr plus cifs_qfs_tcon QUERY_FS_INFO issue TRANS2 automatically, so the server can trigger the UAF with no further user action.\nS:U - The use-after-free corrupts the client kernel\u0027s own CIFS receive-buffer mempool (cifs_req_poolp/cifs_sm_req_poolp) within the same host security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - handle_mid() overwrites mid-\u003eresp_buf without detaching server-\u003ebigbuf/smallbuf, so after the user thread frees the buffer the demux thread reuses the dangling mempool object for the next packet; that use-after-free enables heap reuse and arbitrary kernel memory disclosure.\nI:H - The same dangling server receive buffer is written by cifsd and later freed by the user thread, yielding a kernel heap use-after-free. Attacker-controlled subsequent SMB payloads and heap grooming can turn this into an arbitrary write or control-flow hijack.\nA:H - Reusing a freed CIFS small/large response buffer can fault on poisoned or unmapped slab objects and oops or panic the demux thread, and a malicious server can retrigger the primary-then-malformed-secondary sequence on every multi-part TRANS2."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:16.928Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9eed72e9534b10a6d9f8f5146feff3db53aebdba"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e6533a683f6a851158d9f33fb4ea8f4f25d7f84"
        },
        {
          "url": "https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"
        }
      ],
      "title": "smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89637",
    "datePublished": "2026-09-11T19:45:31.048Z",
    "dateReserved": "2026-09-11T19:38:34.739Z",
    "dateUpdated": "2026-09-13T06:32:16.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89637",
      "date": "2026-09-13",
      "epss": "0.00588",
      "percentile": "0.46297"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-13T01:02:46.000Z",
      "cve": "CVE-2026-89637",
      "id": "msrc_CVE-2026-89637",
      "initial_release_date": "2026-09-13T01:02:46.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89637.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89637\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:49.370\",\"lastModified\":\"2026-09-13T07:17:28.883\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2\\n\\nWhen a valid primary TRANSACT2 response has been received (mid-\u003eresp_buf\\nset, mid-\u003emultiRsp true) and a subsequent secondary response causes\\ncifs_check_trans2() to return false -- either because the SMB header is\\ninvalid (malformed != 0) or because check2ndT2() rejects the PDU --\\nhandle_mid() overwrites mid-\u003eresp_buf with the new buffer (leaking the\\nprimary buffer) and, because mid-\u003emultiRsp is set, skips the\\nserver-\u003esmallbuf/bigbuf NULL-out.  When the user thread frees\\nmid-\u003eresp_buf, server-\u003esmallbuf or server-\u003ebigbuf is left dangling; the\\ndemux thread reuses it for the next packet, resulting in a use-after-free.\\n\\nCombine both early-exit conditions and, when mid-\u003emultiRsp is already\\nset, abort the pending transaction inline: set multiEnd, call\\ndequeue_mid() with malformed=true, and return true so handle_mid() exits\\nwithout touching mid-\u003eresp_buf or the server buffer pointers.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb1transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"316cf94a910f6f93d43cc574359d163ccae098a3\",\"lessThan\":\"9eed72e9534b10a6d9f8f5146feff3db53aebdba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"316cf94a910f6f93d43cc574359d163ccae098a3\",\"lessThan\":\"5e6533a683f6a851158d9f33fb4ea8f4f25d7f84\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"316cf94a910f6f93d43cc574359d163ccae098a3\",\"lessThan\":\"730d0bb19507b9e19c2fe5343109ac618e2fbce5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/smb1transport.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5e6533a683f6a851158d9f33fb4ea8f4f25d7f84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9eed72e9534b10a6d9f8f5146feff3db53aebdba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:51:01+00:00",
      "cve": "CVE-2026-89637",
      "id": "CVE-2026-89637",
      "initial_release_date": "2026-09-11T19:45:31.048000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Use-After-Free vulnerability in SMB client due to malformed TRANSACT2 response",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89637.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-09-12T16:24:34Z",
      "cve": "CVE-2026-89637",
      "id": "CVE-2026-89637",
      "initial_release_date": "2026-09-12T16:24:34Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89637",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89637.json",
      "version": "2"
    }
  }
}

FKIE_CVE-2026-89637

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-09-13 07:17

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5e6533a683f6a851158d9f33fb4ea8f4f25d7f84
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9eed72e9534b10a6d9f8f5146feff3db53aebdba

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb1transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9eed72e9534b10a6d9f8f5146feff3db53aebdba",
              "status": "affected",
              "version": "316cf94a910f6f93d43cc574359d163ccae098a3",
              "versionType": "git"
            },
            {
              "lessThan": "5e6533a683f6a851158d9f33fb4ea8f4f25d7f84",
              "status": "affected",
              "version": "316cf94a910f6f93d43cc574359d163ccae098a3",
              "versionType": "git"
            },
            {
              "lessThan": "730d0bb19507b9e19c2fe5343109ac618e2fbce5",
              "status": "affected",
              "version": "316cf94a910f6f93d43cc574359d163ccae098a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb1transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2\n\nWhen a valid primary TRANSACT2 response has been received (mid-\u003eresp_buf\nset, mid-\u003emultiRsp true) and a subsequent secondary response causes\ncifs_check_trans2() to return false -- either because the SMB header is\ninvalid (malformed != 0) or because check2ndT2() rejects the PDU --\nhandle_mid() overwrites mid-\u003eresp_buf with the new buffer (leaking the\nprimary buffer) and, because mid-\u003emultiRsp is set, skips the\nserver-\u003esmallbuf/bigbuf NULL-out.  When the user thread frees\nmid-\u003eresp_buf, server-\u003esmallbuf or server-\u003ebigbuf is left dangling; the\ndemux thread reuses it for the next packet, resulting in a use-after-free.\n\nCombine both early-exit conditions and, when mid-\u003emultiRsp is already\nset, abort the pending transaction inline: set multiEnd, call\ndequeue_mid() with malformed=true, and return true so handle_mid() exits\nwithout touching mid-\u003eresp_buf or the server buffer pointers."
    }
  ],
  "id": "CVE-2026-89637",
  "lastModified": "2026-09-13T07:17:28.883",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-11T20:19:49.370",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5e6533a683f6a851158d9f33fb4ea8f4f25d7f84"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9eed72e9534b10a6d9f8f5146feff3db53aebdba"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-Q27P-5553-XHRR

Vulnerability from github – Published: 2026-09-11 21:31 – Updated: 2026-09-13 09:32

Details

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2

When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free.

Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeue_mid() with malformed=true, and return true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89637"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T20:19:49Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2\n\nWhen a valid primary TRANSACT2 response has been received (mid-\u003eresp_buf\nset, mid-\u003emultiRsp true) and a subsequent secondary response causes\ncifs_check_trans2() to return false -- either because the SMB header is\ninvalid (malformed != 0) or because check2ndT2() rejects the PDU --\nhandle_mid() overwrites mid-\u003eresp_buf with the new buffer (leaking the\nprimary buffer) and, because mid-\u003emultiRsp is set, skips the\nserver-\u003esmallbuf/bigbuf NULL-out.  When the user thread frees\nmid-\u003eresp_buf, server-\u003esmallbuf or server-\u003ebigbuf is left dangling; the\ndemux thread reuses it for the next packet, resulting in a use-after-free.\n\nCombine both early-exit conditions and, when mid-\u003emultiRsp is already\nset, abort the pending transaction inline: set multiEnd, call\ndequeue_mid() with malformed=true, and return true so handle_mid() exits\nwithout touching mid-\u003eresp_buf or the server buffer pointers.",
  "id": "GHSA-q27p-5553-xhrr",
  "modified": "2026-09-13T09:32:26Z",
  "published": "2026-09-11T21:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89637"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5e6533a683f6a851158d9f33fb4ea8f4f25d7f84"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9eed72e9534b10a6d9f8f5146feff3db53aebdba"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-89637

Vulnerability from csaf_microsoft - Published: 2026-09-13 01:02 - Updated: 2026-09-13 01:02

Summary

smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-89637

Affected products

Under investigation 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-89637 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89637.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2",
    "tracking": {
      "current_release_date": "2026-09-13T01:02:46.000Z",
      "generator": {
        "date": "2026-09-13T07:02:34.804Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-89637",
      "initial_release_date": "2026-09-13T01:02:46.000Z",
      "revision_history": [
        {
          "date": "2026-09-13T01:02:46.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "category": "product_name",
            "name": "azl3 kernel 0:6.6.150.1-1.azl3",
            "product": {
              "name": "azl3 kernel 0:6.6.150.1-1.azl3",
              "product_id": "1"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-89637",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "under_investigation": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-89637 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89637.json"
        }
      ],
      "title": "smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-89637 (GCVE-0-2026-89637)

FKIE_CVE-2026-89637

GHSA-Q27P-5553-XHRR

MSRC_CVE-2026-89637

Tags

Sightings

Nomenclature