CVE-2026-89637
Description
A flaw was found in the Linux kernel's Server Message Block (SMB) client. When processing a malformed secondary TRANSACT2 response, a use-after-free (UAF) vulnerability and a buffer leak can occur in the cifs_check_trans2() function. This can lead to a dangling buffer being reused by the demux thread, potentially allowing an attacker to achieve arbitrary code execution or cause a denial of service.
Statement
This vulnerability is rated as Moderate severity because exploitation requires an established CIFS mount to an adversary-controlled or rogue SMB server, preventing direct unauthenticated remote attack against standard default installations. In typical Red Hat Enterprise Linux deployments, modern SMB2 or SMB3 dialects are negotiated by default, significantly reducing accidental exposure to vulnerable legacy SMB1 transaction handlers. A compromised remote server returning specially crafted secondary transaction responses could trigger kernel memory corruption or a denial of service, but privileged configuration or explicit user interaction to mount the remote share is required.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
