{"id":"CVE-2026-89632","title":"smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()\n\nreparse_buf_ptr() reads buf->ReparseDataLength before checking that\ncount covers the full f…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Linux","product":"Linux","affected":["Linux >= a158bb66b1373866d9fd5997565a58a573085539 < b70bc592afd19732e2e4563300ebe8f974280365","Linux >= 67ec9949b0dfe78c99e110dd975eb7dc5645630c < 711cf71300d7992f450600df8864917d3538679f","Linux >= 67ec9949b0dfe78c99e110dd975eb7dc5645630c < 05f78e6cf34ea3a285053bd5999e08e8ac298bd5","Linux >= 6.6.32 < 6.6.160","Linux 6.8"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T19:24:44.423758Z"},"published":"2026-09-11","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:48:04.460Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89632","references":[{"url":"https://git.kernel.org/stable/c/b70bc592afd19732e2e4563300ebe8f974280365"},{"url":"https://git.kernel.org/stable/c/711cf71300d7992f450600df8864917d3538679f"},{"url":"https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89632.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89632"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532415"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89632"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89632"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89632.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00551,"epssPercentile":0.45887,"scores":{"cna":8.2,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.473Z","slug":"CVE-2026-89632","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()\n\nreparse_buf_ptr() reads buf->ReparseDataLength before checking that\ncount covers the full fixed header:\n\n    buf = (struct reparse_data_buffer *)((u8 *)io + off);\n    len = sizeof(*buf);                          /* 8 bytes */\n    rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */\n\n    if (count < len || count < rdlen + len)      /* check comes after */\n\nstruct reparse_data_buffer has ReparseDataLength at offset 4.  If a\nserver returns OutputCount < 6, the read at offset 4-5 reaches past\nthe end of the received data.  The off+count bounds against iov_len\nwere already validated, but that does not protect against count being\nsmaller than sizeof(*buf).\n\nSplit the check: verify count >= sizeof(*buf) before reading\nReparseDataLength, then verify count covers the data region.\n\n## Affected\n\n- `Linux >= a158bb66b1373866d9fd5997565a58a573085539 < b70bc592afd19732e2e4563300ebe8f974280365`\n- `Linux >= 67ec9949b0dfe78c99e110dd975eb7dc5645630c < 711cf71300d7992f450600df8864917d3538679f`\n- `Linux >= 67ec9949b0dfe78c99e110dd975eb7dc5645630c < 05f78e6cf34ea3a285053bd5999e08e8ac298bd5`\n- `Linux >= 6.6.32 < 6.6.160`\n- `Linux 6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89632.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223273,"id":"CVE-2026-89632","ts":1792180038054,"field":"cvss","old":"7","new":"8.2"},{"seq":208116,"id":"CVE-2026-89632","ts":1789922715795,"field":"cvss","old":"6.3","new":"7"},{"seq":208115,"id":"CVE-2026-89632","ts":1789922715795,"field":"severity","old":"medium","new":"high"},{"seq":202847,"id":"CVE-2026-89632","ts":1789403732652,"field":"cvss","old":"8.2","new":"6.3"},{"seq":202846,"id":"CVE-2026-89632","ts":1789403732652,"field":"severity","old":"high","new":"medium"},{"seq":197838,"id":"CVE-2026-89632","ts":1789384320611,"field":"cvss","old":"6.3","new":"8.2"},{"seq":197837,"id":"CVE-2026-89632","ts":1789384320611,"field":"severity","old":"medium","new":"high"},{"seq":183393,"id":"CVE-2026-89632","ts":1789356675177,"field":"cvss","old":"8.2","new":"6.3"},{"seq":183392,"id":"CVE-2026-89632","ts":1789356675177,"field":"severity","old":"high","new":"medium"},{"seq":153468,"id":"CVE-2026-89632","ts":1789285350639,"field":"cvss","old":null,"new":"8.2"},{"seq":153467,"id":"CVE-2026-89632","ts":1789285350639,"field":"severity","old":"none","new":"high"},{"seq":147213,"id":"CVE-2026-89632","ts":1789270201695,"field":"cvss","old":null,"new":"6.3"},{"seq":147212,"id":"CVE-2026-89632","ts":1789270201695,"field":"severity","old":"none","new":"medium"},{"seq":108968,"id":"CVE-2026-89632","ts":1789183729774,"field":"cvss","old":null,"new":"6.3"},{"seq":108967,"id":"CVE-2026-89632","ts":1789183729774,"field":"severity","old":"none","new":"medium"}]}