UBUNTU-CVE-2026-89634: Critical severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlinkdata() error context loop The check added by commit 7d9a7f1f96cd ("smb/client: fix possible infinite loop and oob read in symlinkdata()") compared the post-ALIGN length against the remaining buffer, but ALIGN() itself can overflow: for ErrorDataLength near UINT32MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8) wraps to 0, so the subsequent bounds check passes, and the loop advances by zero bytes leaving 'p' pointing into stale data. Fix by checking the raw ErrorDataLength against the remaining space before applying ALIGN(), then checking again after. Since rawlen is bounded by the buffer, rawlen + 7 cannot overflow, so the second check is an exact post-alignment bounds guard.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In smb client symlink_data() error-context processing, check raw ErrorDataLength against the remaining buffer before applying ALIGN(), then check the aligned length against the remaining buffer again before advancing the pointer.
Event History
Frequently Asked Questions
Which Ubuntu systems should be prioritized for review?
Systems running the listed Ubuntu kernel packages should be reviewed: linux-azure, linux-azure-fde, linux-riscv, linux-realtime, linux-gcp, linux-gke, linux-azure-fips, and linux-hwe-edge. Exposure is tied to the SMB client processing malformed error-context data.
What does exploitation require?
The vulnerability is rated network-accessible with low attack complexity, no privileges, and no user interaction required. An attacker would need to cause an affected SMB client to process an error context with a crafted ErrorDataLength value near UINT32_MAX.
What is the expected security impact?
The supplied severity vector indicates high confidentiality and availability impact, with no integrity impact. The flaw can cause the SMB client parsing loop to advance by zero bytes and continue operating on stale data.