CVE-2026-89633

A flaw was found in the Linux kernel's Server Message Block (SMB) client. The coalesce_t2() function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-bounds read and write operations, potentially resulting in information disclosure or arbitrary code execution.

This vulnerability is rated as Important because an attacker controlling an SMB server can trigger kernel heap corruption on a client system, though exploitation requires an active connection to an untrusted or compromised file share. Under default configurations in Red Hat Enterprise Linux, the kernel CIFS client negotiates modern SMB dialects rather than the legacy SMBv1 protocol where this transaction reassembly logic resides. Consequently, systems are only exposed when administrators explicitly configure mounts using deprecated SMBv1 or establish connections to untrusted endpoints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the cifs kernel module from loading if mounting SMB network file shares is not required.

1. Create a configuration file to blacklist the module:

echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf
echo "blacklist cifs" >> /etc/modprobe.d/disable-cifs.conf

2. If the module is currently loaded into memory, unload it:

modprobe -r cifs

Caveats: Disabling this module prevents the system from mounting remote CIFS and SMB file systems. If active SMB shares are in use, all shares must be unmounted before unloading the module, or a system restart is required to apply the changes.