CRITICAL Introduced in 2.6.12
smb DataOffset OOB
CVE-2026-89633
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI9.8CRITICAL
01Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); data_area_of_tgt += total_in_tgt; ... memcpy(data_area_of_tgt, data_area_of_src, total_in_src); A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target). The BCC overflow guard does not prevent this: BCC reflects how much data is present, while DataOffset controls where in the buffer it starts. The "validate target area" comment present since the function was first written in 2005 was a placeholder that was never implemented. Add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified.
02KernelScan AI Analysis
Risk summary
Any Linux system that mounts SMB1 (CIFS) shares is at risk from a malicious or man-in-the-middle server. The server can send crafted transaction responses that cause out-of-bounds heap reads and writes in the client kernel, potentially leading to information disclosure, memory corruption, or kernel crashes. The impact is critical because the attacker needs no client-side privileges and exploitation is straightforward.
Vulnerability analysis
The SMB1 client's transaction response coalescing function computes data buffer pointers directly from server-supplied offset fields without checking whether those offsets fall within the allocated response buffer. A malicious or compromised SMB server can send crafted Transact2 responses with out-of-range DataOffset values, causing the client kernel to read from or write to heap memory outside the intended buffer — including overwriting SMB header fields or reading past the buffer end. The fix adds lower- and upper-bound validation for both the source and target data pointers before any memory copy or header modification is performed, returning a protocol error if the offsets are invalid. The vulnerability is reachable whenever a Linux system mounts and accesses an SMB1 share; the attacker is the server (or a network attacker who can tamper with server responses) and requires no privileges on the client machine.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 2.6.12 | 6.18.51 | 672cf86aa6aa |
| 7.2 | 2.6.12 | 7.2.4 | 033bc80019f0 |
| mainline | 2.6.12 | 7.3-rc1 | 6343c1da5619 |