CVE-2026-89637

A flaw was found in the Linux kernel's Server Message Block (SMB) client. When processing a malformed secondary TRANSACT2 response, a use-after-free (UAF) vulnerability and a buffer leak can occur in the cifs_check_trans2() function. This can lead to a dangling buffer being reused by the demux thread, potentially allowing an attacker to achieve arbitrary code execution or cause a denial of service.

This vulnerability is rated as Moderate severity because exploitation requires an established CIFS mount to an adversary-controlled or rogue SMB server, preventing direct unauthenticated remote attack against standard default installations. In typical Red Hat Enterprise Linux deployments, modern SMB2 or SMB3 dialects are negotiated by default, significantly reducing accidental exposure to vulnerable legacy SMB1 transaction handlers. A compromised remote server returning specially crafted secondary transaction responses could trigger kernel memory corruption or a denial of service, but privileged configuration or explicit user interaction to mount the remote share is required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.