{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-89633", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-89633" ], "published": "2026-09-11T19:47:07Z", "summary": "smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()\n\ncoalesce_t2() computes data pointers directly from server-supplied\nDataOffset fields with no validation against buffer bounds:\n\n data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +\n get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);\n data_area_of_src = (char *)&pSMBs->hdr.Protocol +\n get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);\n data_area_of_tgt += total_in_tgt;\n ...\n memcpy(data_area_of_tgt, data_area_of_src, total_in_src);\n\nA small DataOffset can push a pointer below the actual byte area,\noverwriting header fields; a large one can push it past the buffer\nend, causing out-of-bounds heap reads (source) or writes (target).\nThe BCC overflow guard does not prevent this: BCC reflects how much\ndata is present, while DataOffset controls where in the buffer it\nstarts.\n\nThe \"validate target area\" comment present since the function was\nfirst written in 2005 was a placeholder that was never implemented.\n\nAdd lower- and upper-bound checks for both data pointers before the\nmemcpy, and before any target header fields are modified.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null, "compiled_filter": false } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.50-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.50+rpt-rpi-2712", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v6", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v7", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt", "binary_version": "1:6.18.50-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.50-1+rpt1": { "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7", "upstream_version": "6.18.50", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.51" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89633" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/033bc80019f07d158630df4e69b19a49010f54f1" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-13T06:49:25Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 9.8, "cvss_v3_severity": "Critical", "scenario": "AV:N - coalesce_t2() runs in cifs_demultiplex_thread on SMB1 TRANS2 responses received over TCP/445; a malicious or compromised SMB1 server (or MITM on an unsigned session) delivers the crafted DataOffset/DataCount fields entirely over the network.\nAC:L - The server fully controls DataOffset, DataCount, and TotalDataCount in both primary and secondary TRANS2 PDUs and can force a large first fragment so mid->resp_buf is set; the unbounded memcpy is deterministic with no race or condition outside the attacker\u2019s control.\nPR:N - The attacker is the remote SMB peer and needs no account or privileges on the victim; coalesce_t2() runs in the demux thread before validate_t2() or any local capability check, and session credentials belong to the client mount, not the attacking server.\nUI:N - Once an SMB1 CIFS mount exists (fstab, autofs, embedded/industrial NAS; CONFIG_CIFS_ALLOW_INSECURE_LEGACY defaults on), reconnect and ordinary lookup/readdir/getattr plus cifs_qfs_tcon QUERY_FS_INFO issue TRANS2 automatically, so the server can trigger coalescing with no further user action.\nS:U - The out-of-bounds heap read/write corrupts the client kernel\u2019s own cifs_request slab within the same host security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - An unvalidated source DataOffset lets memcpy read far past the secondary response (DataOffset is a 16-bit value up to 65535 versus a ~16KB cifs_request object), disclosing adjacent kernel heap; the same memory-corruption primitive can be leveraged for further disclosure.\nI:H - An unvalidated target DataOffset lets memcpy write attacker-controlled bytes past the primary buffer (or backward into the SMB header); the BCC-size guard does not constrain where the copy starts, yielding an out-of-bounds write exploitable for control-flow hijacking.\nA:H - Reading or writing tens of kilobytes past the cifs_request allocation can fault on unmapped pages and oops or panic the demux thread, and a malicious server can retrigger it on every multi-part TRANS2." } } }