CVE-2026-89634

A flaw was found in the Server Message Block (SMB) client within the Linux kernel. An integer overflow in the ALIGN() function, specifically within the symlink_data() error context loop, can lead to an out-of-bounds read. This issue allows a malicious SMB server to cause a denial of service (DoS) by triggering an infinite loop or potentially disclose sensitive information.

SMB client symlink_data can mishandle a crafted ErrorDataLength because ALIGN() is applied before the raw length is checked. A malicious or compromised SMB server can send a very large ErrorDataLength such as 0xFFFFFFF9 so the aligned length wraps to zero and the parser may keep processing stale data or read beyond the intended error context. For the CVSS the PR:N because the attacker only needs to control or tamper with the SMB server response after the client reaches the server, while victim side mounting or access to the share is represented by UI:R. The issue is network reachable from the server side to the SMB client and the main impact is denial of service through a client kernel hang or crash. The paranoid score also allows C:L because stale or out of bounds reads are plausible, but it does not assume privilege escalation or arbitrary write.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.