---
id: CVE-2026-89633
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

  coalesce_t2() computes data pointers directly from server-supplied
  DataOffset fields with …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

  coalesce_t2() computes data pointers directly from server-supplied
  DataOffset fields with …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e4eb295d38b57f4d4b956942a48887eb252d97c6 <
    36d01415d881d5326a0dd3384f781cd7e69aff2d
  - >-
    Linux >= e4eb295d38b57f4d4b956942a48887eb252d97c6 <
    672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e
  - >-
    Linux >= e4eb295d38b57f4d4b956942a48887eb252d97c6 <
    033bc80019f07d158630df4e69b19a49010f54f1
  - >-
    Linux >= e4eb295d38b57f4d4b956942a48887eb252d97c6 <
    6343c1da561962688f203362d80d6a3bfa39fa1b
  - Linux 2.6.12
published: '2026-09-11'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:54.450'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89633'
references:
  - url: 'https://git.kernel.org/stable/c/033bc80019f07d158630df4e69b19a49010f54f1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/36d01415d881d5326a0dd3384f781cd7e69aff2d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89633.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89633'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532230'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89633'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89633'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89633.mbox
  - url: 'https://access.redhat.com/errata/RHSA-2026:85321'
  - url: 'https://access.redhat.com/errata/RHSA-2026:86033'
  - url: 'https://git.kernel.org/stable/c/6eb70b78e48b0031bd1a05fe1b58959a48e87739'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00491
epssPercentile: 0.41974
scores:
  nvd: 9.8
  cna: 9.8
  vendor: 8
ingestedAt: '2026-09-14T15:23:07.474Z'
patched:
  - 10base_smtv
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_9
  - enterprise_linux_baseos_v_10
  - enterprise_linux_baseos_v_9
  - enterprise_linux_codeready_linux_builder_v_10
  - enterprise_linux_codeready_linux_builder_v_9
  - enterprise_linux_hidden_v_10
  - enterprise_linux_real_time_for_nfv_v_10
  - enterprise_linux_real_time_for_nfv_v_9
  - enterprise_linux_real_time_v_10
  - enterprise_linux_real_time_v_9
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

coalesce_t2() computes data pointers directly from server-supplied
DataOffset fields with no validation against buffer bounds:

  data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
                     get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
  data_area_of_src = (char *)&pSMBs->hdr.Protocol +
                     get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
  data_area_of_tgt += total_in_tgt;
  ...
  memcpy(data_area_of_tgt, data_area_of_src, total_in_src);

A small DataOffset can push a pointer below the actual byte area,
overwriting header fields; a large one can push it past the buffer
end, causing out-of-bounds heap reads (source) or writes (target).
The BCC overflow guard does not prevent this: BCC reflects how much
data is present, while DataOffset controls where in the buffer it
starts.

The "validate target area" comment present since the function was
first written in 2005 was a placeholder that was never implemented.

Add lower- and upper-bound checks for both data pointers before the
memcpy, and before any target header fields are modified.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89633.json)
- **RHSA-2026:85321** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:85321)
- **RHSA-2026:86033** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86033)