CVE-2026-89632
Description
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A malicious server could exploit this vulnerability by sending specially crafted data, leading to an out-of-bounds read. This occurs because the reparse_buf_ptr() function reads data before properly validating the buffer size, allowing it to access memory beyond the intended boundary.
Statement
An out-of-bounds read in the SMB client reparse buffer parser can occur because reparse_buf_ptr() reads ReparseDataLength before verifying that OutputCount covers the fixed reparse_data_buffer header. A malicious or compromised SMB server can return a short response with OutputCount smaller than 6, causing the client kernel to read past the received data while processing a reparse point response. For the CVSS the PR:N because the attacker does not need local privileges on the client and only needs the ability to act as or influence the SMB server response. UI:R is used because the client normally has to connect to or access the malicious SMB share. Impact is at least limited confidentiality exposure from a kernel out-of-bounds read and possible denial of service if the invalid read faults or is caught by hardening. No direct privilege escalation primitive is evident because the patch shows a read before validation and not a write or UAF.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | 8.2 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
