GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89630 (GCVE-0-2026-89630)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:32
VLAI
Title
smb: client: restore the data_offset bound in is_valid_oplock_break()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break() Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") changed the quantity this bound is measured against. It used to be srv->total_read minus the 4-byte RFC1002 preamble that total_read then included, so it was the SMB message length. The same commit stopped counting the preamble, and the mechanical substitution to srv->total_read - srv->pdu_size left an expression that is identically zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly pdu_length - MID_HEADER_SIZE() more, adding both to total_read. len is therefore 0, the subtraction below it wraps, and no __u32 DataOffset can exceed the result, so the check from commit 097f5863b1a0 ("cifs: read overflow in is_valid_oplock_break()") no longer rejects anything. Use total_read, which is now the message length on its own.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 83bfbd0bb9025f98fa62b44f93bd67466773d1db , < 5b16a1967a01ad4496a7206a87c3eb16f1df2b05 (git)
Affected: 83bfbd0bb9025f98fa62b44f93bd67466773d1db , < ba22f575de9deeae4ae0859ca4315a7698226237 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb1misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5b16a1967a01ad4496a7206a87c3eb16f1df2b05",
              "status": "affected",
              "version": "83bfbd0bb9025f98fa62b44f93bd67466773d1db",
              "versionType": "git"
            },
            {
              "lessThan": "ba22f575de9deeae4ae0859ca4315a7698226237",
              "status": "affected",
              "version": "83bfbd0bb9025f98fa62b44f93bd67466773d1db",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb1misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: restore the data_offset bound in is_valid_oplock_break()\n\nCommit 83bfbd0bb902 (\"cifs: Remove the RFC1002 header from smb_hdr\")\nchanged the quantity this bound is measured against.  It used to be\nsrv-\u003etotal_read minus the 4-byte RFC1002 preamble that total_read then\nincluded, so it was the SMB message length.  The same commit stopped\ncounting the preamble, and the mechanical substitution to\nsrv-\u003etotal_read - srv-\u003epdu_size left an expression that is identically\nzero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly\npdu_length - MID_HEADER_SIZE() more, adding both to total_read.\n\nlen is therefore 0, the subtraction below it wraps, and no __u32\nDataOffset can exceed the result, so the check from commit 097f5863b1a0\n(\"cifs: read overflow in is_valid_oplock_break()\") no longer rejects\nanything.  Use total_read, which is now the message length on its own."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the in-kernel SMB1 client demultiplex path: a remote peer sends an unsolicited SMB_COM_NT_TRANSACT response over TCP/445 and cifs_demultiplex_thread() calls is_valid_oplock_break() on unmatched frames, so a malicious or compromised SMB server (or MITM) reaches it via network protocol data.\nAC:L - The attacker fully controls Command, Flags, ByteCount, and DataOffset in a single unsolicited frame; the broken bound wraps so any DataOffset is accepted and the resulting heap over-read is deterministic, with no race or condition the attacker cannot influence once the client is on the SMB1 connection.\nPR:N - A matching MID, session setup, or tree connect is not required: after negotiate, an unmatched NT_TRANSACT+RESPONSE frame is treated as an oplock/dnotify break before authentication, so the malicious server needs no credentials or privileges on the client host.\nUI:N - On a persistent SMB1 mount (cifsroot, automount, or an already-mounted legacy NAS share) the cifsd thread processes unsolicited frames after the existing connection or reconnect, so no additional victim action is required at attack time.\nS:U - The out-of-bounds/use-after-free read occurs in kernel heap used by the CIFS client on the same host kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Attacker-controlled DataOffset displaces file_notify_information into adjacent or freed cifs_small_rq slab objects (KASAN use-after-free read), and printing FileName with %s can walk unbounded kernel memory, so the disclosure is not limited to a few bounded bytes.\nI:N - The displaced pointer is only read (Action and FileName for a debug print); the bug does not write through that pointer or otherwise provide a kernel memory-modification or control-flow primitive.\nA:H - The KASAN-confirmed slab use-after-free and unmapped over-read run in the cifsd demultiplex thread and can oops or panic the kernel, and a malicious peer can repeat the unsolicited frame to retrigger the crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:08.588Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5b16a1967a01ad4496a7206a87c3eb16f1df2b05"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba22f575de9deeae4ae0859ca4315a7698226237"
        }
      ],
      "title": "smb: client: restore the data_offset bound in is_valid_oplock_break()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89630",
    "datePublished": "2026-09-11T19:45:25.697Z",
    "dateReserved": "2026-09-11T19:38:34.738Z",
    "dateUpdated": "2026-09-13T06:32:08.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89630",
      "date": "2026-09-17",
      "epss": "0.00396",
      "percentile": "0.33459"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89630\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:48.517\",\"lastModified\":\"2026-09-13T07:17:28.067\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: restore the data_offset bound in is_valid_oplock_break()\\n\\nCommit 83bfbd0bb902 (\\\"cifs: Remove the RFC1002 header from smb_hdr\\\")\\nchanged the quantity this bound is measured against.  It used to be\\nsrv-\u003etotal_read minus the 4-byte RFC1002 preamble that total_read then\\nincluded, so it was the SMB message length.  The same commit stopped\\ncounting the preamble, and the mechanical substitution to\\nsrv-\u003etotal_read - srv-\u003epdu_size left an expression that is identically\\nzero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly\\npdu_length - MID_HEADER_SIZE() more, adding both to total_read.\\n\\nlen is therefore 0, the subtraction below it wraps, and no __u32\\nDataOffset can exceed the result, so the check from commit 097f5863b1a0\\n(\\\"cifs: read overflow in is_valid_oplock_break()\\\") no longer rejects\\nanything.  Use total_read, which is now the message length on its own.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb1misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"83bfbd0bb9025f98fa62b44f93bd67466773d1db\",\"lessThan\":\"5b16a1967a01ad4496a7206a87c3eb16f1df2b05\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"83bfbd0bb9025f98fa62b44f93bd67466773d1db\",\"lessThan\":\"ba22f575de9deeae4ae0859ca4315a7698226237\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/smb1misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5b16a1967a01ad4496a7206a87c3eb16f1df2b05\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ba22f575de9deeae4ae0859ca4315a7698226237\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T17:46:37+00:00",
      "cve": "CVE-2026-89630",
      "id": "CVE-2026-89630",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: restore the data_offset bound in is_valid_oplock_break()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89630.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-09-13T16:57:50Z",
      "cve": "CVE-2026-89630",
      "id": "CVE-2026-89630",
      "initial_release_date": "2026-09-12T16:24:38Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89630",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89630.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.