CVE-2026-89632: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-before-check of ReparseDataLength in reparsebufptr()
reparsebufptr() reads buf->ReparseDataLength before checking that count covers the full fixed header:
buf = (struct reparsedatabuffer )((u8 )io + off); len = sizeof(buf); / 8 bytes / rdlen = le16tocpu(buf->ReparseDataLength); / offset 4, 2 bytes /
if (count < len || count < rdlen + len) / check comes after /
struct reparsedatabuffer has ReparseDataLength at offset 4. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data. The off+count bounds against iovlen were already validated, but that does not protect against count being smaller than sizeof(buf).
Split the check: verify count >= sizeof(buf) before reading ReparseDataLength, then verify count covers the data region.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In reparse_buf_ptr(), verify count >= sizeof(*buf) before reading ReparseDataLength, then verify that count covers the data region (count >= rdlen + len).
Event History
Frequently Asked Questions
Who can trigger this issue?
A server supplying SMB responses can trigger it by returning a reparse-data response whose OutputCount is smaller than 6. This makes SMB clients that process that response the exposed side.
What must an attacker control or send to exploit the flaw?
The attacker needs to cause the SMB client to process a response containing a reparse data buffer with an insufficient OutputCount. The vulnerable code reads ReparseDataLength at offsets 4-5 before confirming that the received count includes the complete fixed header.
How can I tell whether a system has the fix?
The fix changes reparse_buf_ptr() so it verifies count is at least sizeof(struct reparse_data_buffer) before reading ReparseDataLength, and only then verifies that count covers the data region. The provided stable kernel references identify commits containing this correction.