HIGH Introduced in 6.6.32
smb ReparseBuffer OOB
CVE-2026-89632
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
KernelScan AI5.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() reparse_buf_ptr() reads buf->ReparseDataLength before checking that count covers the full fixed header: buf = (struct reparse_data_buffer *)((u8 *)io + off); len = sizeof(*buf); /* 8 bytes */ rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */ if (count < len || count < rdlen + len) /* check comes after */ struct reparse_data_buffer has ReparseDataLength at offset 4. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data. The off+count bounds against iov_len were already validated, but that does not protect against count being smaller than sizeof(*buf). Split the check: verify count >= sizeof(*buf) before reading ReparseDataLength, then verify count covers the data region.
02KernelScan AI Analysis
Risk summary
A malicious SMB server can return a truncated reparse point response, causing the Linux SMB client to read 2 bytes past the end of the received data before validating the response size. Any device that mounts SMB shares is at risk; the impact is limited to a potential kernel oops with no confirmed data disclosure or corruption.
Vulnerability analysis
When the Linux SMB client queries a reparse point (e.g., a symlink) on a remote share, it reads a length field from the server's response before checking that the response is large enough to contain that field. A malicious or buggy server returning a response shorter than 6 bytes causes the client to read 2 bytes past the end of the received data. The read value is only used in a subsequent size comparison and is not returned to userspace, so there is no confirmed information disclosure, but the out-of-bounds access could trigger a kernel oops in rare cases. The fix reorders the validation so the client first confirms the response is at least as large as the fixed header, then reads the length field, then verifies the data region fits. Any system that mounts SMB shares and accesses files with reparse points is exposed; the attacker is the server (or a man-in-the-middle who can alter SMB responses), requiring no privileges on the client.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 6.6.32 | 7.3-rc1 | 711cf71300d7 |