CVE-2026-89633: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix OOB read/write from unvalidated DataOffset in coalescet2()
coalescet2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds:
dataareaoftgt = (char )&pSMBt->hdr.Protocol + getunalignedle16(&pSMBt->t2rsp.DataOffset); dataareaofsrc = (char )&pSMBs->hdr.Protocol + getunalignedle16(&pSMBs->t2rsp.DataOffset); dataareaoftgt += totalintgt; ... memcpy(dataareaoftgt, dataareaofsrc, totalinsrc);
A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target). The BCC overflow guard does not prevent this: BCC reflects how much data is present, while DataOffset controls where in the buffer it starts.
The "validate target area" comment present since the function was first written in 2005 was a placeholder that was never implemented.
Add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.51 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1038.42 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.115-2~deb12u1 - Compensating control
In coalesce_t2(), add lower- and upper-bound checks for both source and target data pointers before memcpy and before modifying any target header fields.
Event History
Frequently Asked Questions
What does an attacker need to control to trigger this issue?
An attacker needs to provide SMB Transaction2 response data with a crafted DataOffset value that is processed by coalesce_t2(). This makes systems acting as SMB clients the relevant exposure point.
What can a malicious SMB response cause?
A small DataOffset can redirect writes into SMB header fields, while a large DataOffset can cause out-of-bounds heap reads from the source buffer or writes to the target buffer. The existing BCC overflow guard does not validate the DataOffset-controlled pointer location.