CVE-2026-89631

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated memory buffer. Consequently, sensitive information from kernel memory may be exposed to a local user through the /proc/fs/cifs/DebugData interface.

This vulnerability is rated as Important because an untrusted or compromised SMB server can induce an out-of-bounds memory read on a client system, potentially causing a kernel crash or exposing sensitive kernel slab data to local users. Exposure across Red Hat Enterprise Linux environments is limited to systems configured to mount remote CIFS or SMB file shares, as these network filesystems are not mounted by default. Exploitation requires an active connection to an adversary-controlled server, meaning standalone systems or clients restricted to trusted internal shares are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the cifs kernel module from loading if SMB/CIFS network share functionality is not required.

1. Add a configuration file to disable the module:

echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf

2. Unload the module if it is currently loaded:

modprobe -r cifs

Caveats: Disabling the cifs module prevents mounting any CIFS or SMB network file shares. If the module is actively in use by mounted filesystems, it cannot be unloaded dynamically and a system reboot will be required for the configuration to take effect. If SMB connectivity is necessary, ensure systems only connect to trusted file servers.