CVE-2026-89634: smb: client: fix ALIGN() overflow in symlink_data() error context loop
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix ALIGN() overflow in symlinkdata() error context loop
The check added by commit 7d9a7f1f96cd ("smb/client: fix possible infinite loop and oob read in symlinkdata()") compared the post-ALIGN length against the remaining buffer, but ALIGN() itself can overflow: for ErrorDataLength near UINT32MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8) wraps to 0, so the subsequent bounds check passes, and the loop advances by zero bytes leaving 'p' pointing into stale data.
Fix by checking the raw ErrorDataLength against the remaining space before applying ALIGN(), then checking again after. Since rawlen is bounded by the buffer, rawlen + 7 cannot overflow, so the second check is an exact post-alignment bounds guard.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 7d9a7f1f96cd - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch smb: client: fix ALIGN() overflow in symlink_data() error context loop
Event History
Frequently Asked Questions
What malformed value is needed to reach the flawed bounds check?
The issue occurs when an SMB error context supplies an ErrorDataLength near UINT32_MAX, such as 0xFFFFFFF9. Aligning that value to an 8-byte boundary can wrap to zero.
What happens when the length alignment wraps?
The post-alignment bounds check can pass because the aligned value is zero. The parsing loop then advances by zero bytes and leaves its pointer in stale data.
How can I verify that a fix includes the necessary protection?
The corrected code checks the raw ErrorDataLength against remaining buffer space before calling ALIGN(), then performs a second bounds check after alignment. The referenced stable commits are 657372ba6ea50b4474d2a6a610097eae8cd1f3e9, 1f824f61d1df52392eaf0b74dfa5659d724fde30, and 62a3025983c8c735a3c6fc85a59316f31b59af07.