CVE-2026-89630 smb: client: restore the data_offset bound in is_valid_oplock_break()
An integer overflow in the Linux kernel SMB client allows bypassing bounds checks, potentially leading to memory corruption or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89630?
CVE-2026-89630 is a critical vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: restore the data_offset bound in is_valid_oplock_break()
Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") changed the quantity this bound is measured against. It used to be srv->total_read minus the 4-byte RFC1002 preamble that total_read then included, so it was the SMB message length. The same commit stopped counting the preamble, and the mechanical substitution to srv->total_read - srv->pdu_size left an expression that is identically zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly pdu_length - MID_HEADER_SIZE() more, adding both to total_read.
len is therefore 0, the subtraction below it wraps, and no __u32 DataOffset can exceed the result, so the check from commit 097f5863b1a0 ("cifs: read overflow in is_valid_oplock_break()") no longer rejects anything. Use total_read, which is now the message length on its own.
Which versions are affected by CVE-2026-89630?
How do I fix CVE-2026-89630?
Apply the vendor's patch.
Is CVE-2026-89630 being exploited?
There is no known exploitation of CVE-2026-89630 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-89630, DEBIAN-CVE-2026-89630, GHSA-gch3-h386-3492, UBUNTU-CVE-2026-89630.