CVE-2026-89633

CVE CVE-2026-89633EUVD EUVD-2026-76545Published 2026-09-11T19:45:28.000ZLast changed 2026-09-13T06:32:12.000ZCVSS 9.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); data_area_of_tgt += total_in_tgt; ... memcpy(data_area_of_tgt, data_area_of_src, total_in_src); A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target). The BCC overflow guard does not prevent this: BCC reflects how much data is present, while DataOffset controls where in the buffer it starts. The "validate target area" comment present since the function was first written in 2005 was a placeholder that was never implemented. Add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux e4eb295d38b57f4d4b956942a48887eb252d97c6 <033bc80019f07d158630df4e69b19a49010f54f1; patch: 7.3-rc1; 2.6.12; patch: 0; e4eb295d38b57f4d4b956942a48887eb252d97c6 <6343c1da561962688f203362d80d6a3bfa39fa1b; e4eb295d38b57f4d4b956942a48887eb252d97c6 <672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e; patch: 7.2.4; patch: 6.18.51

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.