CRITICAL Introduced in 6.19
smb OplockBreak OOB
CVE-2026-89630
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
KernelScan AI9.1CRITICAL
01Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break() Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") changed the quantity this bound is measured against. It used to be srv->total_read minus the 4-byte RFC1002 preamble that total_read then included, so it was the SMB message length. The same commit stopped counting the preamble, and the mechanical substitution to srv->total_read - srv->pdu_size left an expression that is identically zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly pdu_length - MID_HEADER_SIZE() more, adding both to total_read. len is therefore 0, the subtraction below it wraps, and no __u32 DataOffset can exceed the result, so the check from commit 097f5863b1a0 ("cifs: read overflow in is_valid_oplock_break()") no longer rejects anything. Use total_read, which is now the message length on its own.
02KernelScan AI Analysis
Risk summary
A malicious or man-in-the-middle SMB server can send a crafted oplock break notification that bypasses a disabled bounds check in the Linux SMB1 client, causing the kernel to read from an attacker-controlled offset beyond the receive buffer. This can leak kernel memory or crash the client. Any system mounting SMB1 shares from untrusted or network-exposed servers is at risk.
Vulnerability analysis
The SMB client's oplock break handler validates a server-supplied offset against the received message length, but a prior refactoring that removed the protocol header left the length variable identically zero. The subsequent subtraction wraps around, so the bound check always passes and any offset value is accepted. The fix restores the correct message-length variable so the validation once again rejects offsets that would read past the end of the buffer. An attacker acting as a malicious SMB server or performing a man-in-the-middle attack can trigger this by sending a crafted oplock break response to a client that has an active SMB1 mount, causing the kernel to read beyond the allocated receive buffer.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18.56 | 6.19 | 5b16a1967a01 |
| 7.2 | 6.19 | 7.2.4 | ba22f575de9d |
| mainline | 6.19 | 7.3-rc1 | — |