---
id: CVE-2026-89637
title: >-
  smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed
  secondary T2
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed
  secondary T2


  When a valid primary TRANSACT2 response has been received (mid->resp_buf

  set, mi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 316cf94a910f6f93d43cc574359d163ccae098a3 <
    9eed72e9534b10a6d9f8f5146feff3db53aebdba
  - >-
    Linux >= 316cf94a910f6f93d43cc574359d163ccae098a3 <
    5e6533a683f6a851158d9f33fb4ea8f4f25d7f84
  - >-
    Linux >= 316cf94a910f6f93d43cc574359d163ccae098a3 <
    730d0bb19507b9e19c2fe5343109ac618e2fbce5
  - Linux 3.6
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:50:09.230Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89637'
references:
  - url: 'https://git.kernel.org/stable/c/9eed72e9534b10a6d9f8f5146feff3db53aebdba'
  - url: 'https://git.kernel.org/stable/c/5e6533a683f6a851158d9f33fb4ea8f4f25d7f84'
  - url: 'https://git.kernel.org/stable/c/730d0bb19507b9e19c2fe5343109ac618e2fbce5'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89637.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89637'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532405'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89637'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89637'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89637.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00597
epssPercentile: 0.48352
scores:
  cna: 9.8
  vendor: 7
ingestedAt: '2026-09-14T15:23:07.476Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2

When a valid primary TRANSACT2 response has been received (mid->resp_buf
set, mid->multiRsp true) and a subsequent secondary response causes
cifs_check_trans2() to return false -- either because the SMB header is
invalid (malformed != 0) or because check2ndT2() rejects the PDU --
handle_mid() overwrites mid->resp_buf with the new buffer (leaking the
primary buffer) and, because mid->multiRsp is set, skips the
server->smallbuf/bigbuf NULL-out.  When the user thread frees
mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the
demux thread reuses it for the next packet, resulting in a use-after-free.

Combine both early-exit conditions and, when mid->multiRsp is already
set, abort the pending transaction inline: set multiEnd, call
dequeue_mid() with malformed=true, and return true so handle_mid() exits
without touching mid->resp_buf or the server buffer pointers.

## Affected

- `Linux >= 316cf94a910f6f93d43cc574359d163ccae098a3 < 9eed72e9534b10a6d9f8f5146feff3db53aebdba`
- `Linux >= 316cf94a910f6f93d43cc574359d163ccae098a3 < 5e6533a683f6a851158d9f33fb4ea8f4f25d7f84`
- `Linux >= 316cf94a910f6f93d43cc574359d163ccae098a3 < 730d0bb19507b9e19c2fe5343109ac618e2fbce5`
- `Linux 3.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89637.json)