GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89632 (GCVE-0-2026-89632)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:45 – Updated: 2026-09-13 06:32
VLAI
Title
smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() reparse_buf_ptr() reads buf->ReparseDataLength before checking that count covers the full fixed header: buf = (struct reparse_data_buffer *)((u8 *)io + off); len = sizeof(*buf); /* 8 bytes */ rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */ if (count < len || count < rdlen + len) /* check comes after */ struct reparse_data_buffer has ReparseDataLength at offset 4. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data. The off+count bounds against iov_len were already validated, but that does not protect against count being smaller than sizeof(*buf). Split the check: verify count >= sizeof(*buf) before reading ReparseDataLength, then verify count covers the data region.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a158bb66b1373866d9fd5997565a58a573085539 , < 711cf71300d7992f450600df8864917d3538679f (git)
Affected: a158bb66b1373866d9fd5997565a58a573085539 , < 05f78e6cf34ea3a285053bd5999e08e8ac298bd5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6.32 , < 7.2.4 (semver)
Affected: 6.6.32 , < 7.3-rc1 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "711cf71300d7992f450600df8864917d3538679f",
              "status": "affected",
              "version": "a158bb66b1373866d9fd5997565a58a573085539",
              "versionType": "git"
            },
            {
              "lessThan": "05f78e6cf34ea3a285053bd5999e08e8ac298bd5",
              "status": "affected",
              "version": "a158bb66b1373866d9fd5997565a58a573085539",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7.2.4",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            },
            {
              "lessThan": "7.3-rc1",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()\n\nreparse_buf_ptr() reads buf-\u003eReparseDataLength before checking that\ncount covers the full fixed header:\n\n    buf = (struct reparse_data_buffer *)((u8 *)io + off);\n    len = sizeof(*buf);                          /* 8 bytes */\n    rdlen = le16_to_cpu(buf-\u003eReparseDataLength); /* offset 4, 2 bytes */\n\n    if (count \u003c len || count \u003c rdlen + len)      /* check comes after */\n\nstruct reparse_data_buffer has ReparseDataLength at offset 4.  If a\nserver returns OutputCount \u003c 6, the read at offset 4-5 reaches past\nthe end of the received data.  The off+count bounds against iov_len\nwere already validated, but that does not protect against count being\nsmaller than sizeof(*buf).\n\nSplit the check: verify count \u003e= sizeof(*buf) before reading\nReparseDataLength, then verify count covers the data region."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the in-kernel SMB client parser for FSCTL_GET_REPARSE_POINT IOCTL replies on TCP/445. A malicious, compromised, or on-path SMB server reaches reparse_buf_ptr() with crafted OutputOffset/OutputCount; this matches sibling client response-parsing scores such as CVE-2026-46155 and CVE-2024-49996.\nAC:L - The server fully controls OutputOffset and OutputCount. A successful IOCTL PDU with OutputCount \u003c 6 and OutputOffset near iov_len (for example a 448-byte cifs_small_rq-sized frame) deterministically loads ReparseDataLength past the received payload, with no race or attacker-uncontrollable layout.\nPR:N - The attacker is the remote SMB server (or a MITM on an unsigned session) and needs no account, credentials, or capabilities on the victim client. GET_REPARSE runs on an already established tree connect after ordinary CREATE/lookup; the client authenticates to the server, not the reverse.\nUI:N - On an already-mounted or automounted CIFS share, any routine lookup/stat of a reparse point \u2014 including files the server flags as reparse in CREATE \u2014 issues FSCTL_GET_REPARSE_POINT. Backup jobs, indexers, and inode revalidation hit the parser with no contemporaneous victim mount action.\nS:U - The two-byte out-of-bounds load and any resulting oops stay inside the client kernel\u0027s security authority. The bug does not cross a VM, IOMMU, or sandbox boundary.\nC:L - The use-before-check reads exactly two bytes of ReparseDataLength past the IOCTL output region (and, when the PDU fills cifs_small_rq, past that 448-byte slab). Those bytes are passed only to smb_EIO2 tracing, so disclosure is strictly bounded, matching CVE-2026-64448 rather than unbounded heap leaks.\nI:N - The out-of-bounds access is a u16 load used only in the subsequent length check and error trace. On failure the helper returns -EIO and does not install a reparse tag or copy payload, so there is no kernel write or metadata-corruption primitive.\nA:H - A PDU that fills the cifs_small_rq or cifs_request slab with OutputOffset at the object end makes the two-byte load a true slab-out-of-bounds access, which KASAN reports as a BUG and which can oops/panic if the next page is unmapped. A malicious server can retrigger it on every GET_REPARSE."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:32:11.058Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/711cf71300d7992f450600df8864917d3538679f"
        },
        {
          "url": "https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5"
        }
      ],
      "title": "smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89632",
    "datePublished": "2026-09-11T19:45:27.325Z",
    "dateReserved": "2026-09-11T19:38:34.738Z",
    "dateUpdated": "2026-09-13T06:32:11.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89632",
      "date": "2026-09-16",
      "epss": "0.00318",
      "percentile": "0.24795"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:51:44.000Z",
      "cve": "CVE-2026-89632",
      "id": "msrc_CVE-2026-89632",
      "initial_release_date": "2026-09-13T01:05:33.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89632.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89632\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:48.763\",\"lastModified\":\"2026-09-13T07:17:28.300\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()\\n\\nreparse_buf_ptr() reads buf-\u003eReparseDataLength before checking that\\ncount covers the full fixed header:\\n\\n    buf = (struct reparse_data_buffer *)((u8 *)io + off);\\n    len = sizeof(*buf);                          /* 8 bytes */\\n    rdlen = le16_to_cpu(buf-\u003eReparseDataLength); /* offset 4, 2 bytes */\\n\\n    if (count \u003c len || count \u003c rdlen + len)      /* check comes after */\\n\\nstruct reparse_data_buffer has ReparseDataLength at offset 4.  If a\\nserver returns OutputCount \u003c 6, the read at offset 4-5 reaches past\\nthe end of the received data.  The off+count bounds against iov_len\\nwere already validated, but that does not protect against count being\\nsmaller than sizeof(*buf).\\n\\nSplit the check: verify count \u003e= sizeof(*buf) before reading\\nReparseDataLength, then verify count covers the data region.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb2inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a158bb66b1373866d9fd5997565a58a573085539\",\"lessThan\":\"711cf71300d7992f450600df8864917d3538679f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a158bb66b1373866d9fd5997565a58a573085539\",\"lessThan\":\"05f78e6cf34ea3a285053bd5999e08e8ac298bd5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/smb2inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6.32\",\"lessThan\":\"7.2.4\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.32\",\"lessThan\":\"7.3-rc1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/711cf71300d7992f450600df8864917d3538679f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:59:38+00:00",
      "cve": "CVE-2026-89632",
      "id": "CVE-2026-89632",
      "initial_release_date": "2026-09-11T19:45:27.325000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel SMB client: Out-of-bounds read vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89632.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-13T16:57:48Z",
      "cve": "CVE-2026-89632",
      "id": "CVE-2026-89632",
      "initial_release_date": "2026-09-12T16:24:37Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89632",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89632.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.