CVE-2026-89631
Description
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated memory buffer. Consequently, sensitive information from kernel memory may be exposed to a local user through the /proc/fs/cifs/DebugData interface.
Statement
This vulnerability is rated as Important because an untrusted or compromised SMB server can induce an out-of-bounds memory read on a client system, potentially causing a kernel crash or exposing sensitive kernel slab data to local users. Exposure across Red Hat Enterprise Linux environments is limited to systems configured to mount remote CIFS or SMB file shares, as these network filesystems are not mounted by default. Exploitation requires an active connection to an adversary-controlled server, meaning standalone systems or clients restricted to trusted internal shares are not exposed.
Mitigation
Prevent the cifs kernel module from loading if SMB/CIFS network share functionality is not required.
1. Add a configuration file to disable the module:
# echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf
2. Unload the module if it is currently loaded:
# modprobe -r cifs
Caveats:
Disabling the cifs module prevents mounting any CIFS or SMB network file shares. If the module is actively in use by mounted filesystems, it cannot be unloaded dynamically and a system reboot will be required for the configuration to take effect. If SMB connectivity is necessary, ensure systems only connect to trusted file servers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
