{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-89632", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-89632" ], "published": "2026-09-11T19:47:07Z", "summary": "smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()\n\nreparse_buf_ptr() reads buf->ReparseDataLength before checking that\ncount covers the full fixed header:\n\n buf = (struct reparse_data_buffer *)((u8 *)io + off);\n len = sizeof(*buf); /* 8 bytes */\n rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */\n\n if (count < len || count < rdlen + len) /* check comes after */\n\nstruct reparse_data_buffer has ReparseDataLength at offset 4. If a\nserver returns OutputCount < 6, the read at offset 4-5 reaches past\nthe end of the received data. The off+count bounds against iov_len\nwere already validated, but that does not protect against count being\nsmaller than sizeof(*buf).\n\nSplit the check: verify count >= sizeof(*buf) before reading\nReparseDataLength, then verify count covers the data region.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.6.47-1+rpt1", "1:6.6.51-1+rpt1", "1:6.6.51-1+rpt2", "1:6.6.51-1+rpt3", "1:6.6.62-1+rpt1", "1:6.6.74-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.6.47+rpt-rpi-2712", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-v6", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-v7", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-v7l", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-v8", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-2712", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v6", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7l", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v8", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-2712", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v6", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7l", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v8", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-2712", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v6", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v7l", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v8", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-2712", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-v6", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-v7", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-v7l", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-v8", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-2712", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-v6", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-v7", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-v7l", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-v8", "binary_version": "1:6.6.74-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.6.47-1+rpt1": { "linux_commit": "cf64a1dfecc2dc418efdd61701c1a4b185ab4761", "upstream_version": "6.6.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.51-1+rpt1": { "linux_commit": "0094eba3f2a4338cfa6854b0b5104d02ba0fa01f", "upstream_version": "6.6.51", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.51-1+rpt2": { "linux_commit": "82a50e430ef1d6eb37d78e25aa572c1f6ea56160", "upstream_version": "6.6.51", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.51-1+rpt3": { "linux_commit": "5aeecea9f4a45248bcf564dec924965e066a7bfd", "upstream_version": "6.6.51", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.62-1+rpt1": { "linux_commit": "dd2394360860d15146c96635796a75b05bb32b61", "upstream_version": "6.6.62", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null }, "1:6.6.74-1+rpt1": { "linux_commit": "a18d9ced4965462cb7b3b4252ada440395105308", "upstream_version": "6.6.74", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89632" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/711cf71300d7992f450600df8864917d3538679f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-13T06:49:25Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.2, "cvss_v3_severity": "High", "scenario": "AV:N - The flaw is in the in-kernel SMB client parser for FSCTL_GET_REPARSE_POINT IOCTL replies on TCP/445. A malicious, compromised, or on-path SMB server reaches reparse_buf_ptr() with crafted OutputOffset/OutputCount; this matches sibling client response-parsing scores such as CVE-2026-46155 and CVE-2024-49996.\nAC:L - The server fully controls OutputOffset and OutputCount. A successful IOCTL PDU with OutputCount < 6 and OutputOffset near iov_len (for example a 448-byte cifs_small_rq-sized frame) deterministically loads ReparseDataLength past the received payload, with no race or attacker-uncontrollable layout.\nPR:N - The attacker is the remote SMB server (or a MITM on an unsigned session) and needs no account, credentials, or capabilities on the victim client. GET_REPARSE runs on an already established tree connect after ordinary CREATE/lookup; the client authenticates to the server, not the reverse.\nUI:N - On an already-mounted or automounted CIFS share, any routine lookup/stat of a reparse point \u2014 including files the server flags as reparse in CREATE \u2014 issues FSCTL_GET_REPARSE_POINT. Backup jobs, indexers, and inode revalidation hit the parser with no contemporaneous victim mount action.\nS:U - The two-byte out-of-bounds load and any resulting oops stay inside the client kernel's security authority. The bug does not cross a VM, IOMMU, or sandbox boundary.\nC:L - The use-before-check reads exactly two bytes of ReparseDataLength past the IOCTL output region (and, when the PDU fills cifs_small_rq, past that 448-byte slab). Those bytes are passed only to smb_EIO2 tracing, so disclosure is strictly bounded, matching CVE-2026-64448 rather than unbounded heap leaks.\nI:N - The out-of-bounds access is a u16 load used only in the subsequent length check and error trace. On failure the helper returns -EIO and does not install a reparse tag or copy payload, so there is no kernel write or metadata-corruption primitive.\nA:H - A PDU that fills the cifs_small_rq or cifs_request slab with OutputOffset at the object end makes the two-byte load a true slab-out-of-bounds access, which KASAN reports as a BUG and which can oops/panic if the next page is unmapped. A malicious server can retrigger it on every GET_REPARSE." } } }