{"id":"CVE-2026-89632","revision":"a4f61186386b4325bfce65789ed62ef6","records":[{"revision":"a4f61186386b4325bfce65789ed62ef6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89632","aliases":[],"title":"smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()\n\nreparse_buf_ptr() reads buf->ReparseDataLength before checking that\ncount covers the full fixed header:\n\n    buf = (struct reparse_data_buffer *)((u8 *)io + off);\n    len = sizeof(*buf);                          /* 8 bytes */\n    rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */\n\n    if (count < len || count < rdlen + len)      /* check comes after */\n\nstruct reparse_data_buffer has ReparseDataLength at offset 4.  If a\nserver returns OutputCount < 6, the read at offset 4-5 reaches past\nthe end of the received data.  The off+count bounds against iov_len\nwere already validated, but that does not protect against count being\nsmaller than sizeof(*buf).\n\nSplit the check: verify count >= sizeof(*buf) before reading\nReparseDataLength, then verify count covers the data region.","state":0,"publishedAt":"2026-09-11T19:45:27.325+00:00","modifiedAt":"2026-10-21T12:48:04.46+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/smb2inode.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a158bb66b1373866d9fd5997565a58a573085539\",\n                            \"lessThan\": \"b70bc592afd19732e2e4563300ebe8f974280365\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"67ec9949b0dfe78c99e110dd975eb7dc5645630c\",\n                            \"lessThan\": \"711cf71300d7992f450600df8864917d3538679f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"67ec9949b0dfe78c99e110dd975eb7dc5645630c\",\n                            \"lessThan\": \"05f78e6cf34ea3a285053bd5999e08e8ac298bd5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.32\",\n                            \"lessThan\": \"6.6.160\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/smb2inode.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","score":8.2,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b70bc592afd19732e2e4563300ebe8f974280365","https://git.kernel.org/stable/c/711cf71300d7992f450600df8864917d3538679f","https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89632","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89632","identifiers":["CVE-2026-89632"]},"retained":false,"historicalAffected":[]}],"coverage":[]}