CVE-2026-89794: ksmbd: zero pipe read compound padding
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: zero pipe read compound padding
Compound response handling extends the last response iov to an eight-byte boundary.
smb2readpipe() allocates only the payload size, so the alignment padding can expose up to seven bytes of uninitialized kernel heap memory.
Allocate the aligned size and clear the unused tail before pinning the response buffer.
Event History
Frequently Asked Questions
What data may be exposed to a remote client?
The issue can disclose up to seven bytes of uninitialized kernel heap memory through alignment padding appended to a compound SMB response.
What request handling path is involved?
The exposure occurs when compound response handling extends the final response I/O vector to an eight-byte boundary and the response buffer was allocated by smb2_read_pipe() only for the payload length.
What does the available fix do?
The fix allocates space for the aligned response size and clears the unused trailing bytes before the response buffer is pinned.