# CVE-2026-89630: smb: client: restore the data_offset bound in is_valid_oplock_break()

> An integer overflow in the Linux kernel SMB client allows bypassing bounds checks, potentially leading to memory corruption or denial of service.

- **Severity:** Critical 9.1 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 11 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** BELL-CVE-2026-89630, DEBIAN-CVE-2026-89630, GHSA-gch3-h386-3492, UBUNTU-CVE-2026-89630

## What is CVE-2026-89630?

CVE-2026-89630 is a critical vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restore the data_offset bound in is_valid_oplock_break()

Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")
changed the quantity this bound is measured against.  It used to be
srv->total_read minus the 4-byte RFC1002 preamble that total_read then
included, so it was the SMB message length.  The same commit stopped
counting the preamble, and the mechanical substitution to
srv->total_read - srv->pdu_size left an expression that is identically
zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly
pdu_length - MID_HEADER_SIZE() more, adding both to total_read.

len is therefore 0, the subtraction below it wraps, and no __u32
DataOffset can exceed the result, so the check from commit 097f5863b1a0
("cifs: read overflow in is_valid_oplock_break()") no longer rejects
anything.  Use total_read, which is now the message length on its own.

## Which versions are affected by CVE-2026-89630?


## How do I fix CVE-2026-89630?

Apply the vendor's patch.

## Is CVE-2026-89630 being exploited?

There is no known exploitation of CVE-2026-89630 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-89630 and fix it if it is affected.

What it is: CVE-2026-89630 is a critical vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-89630 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-89630/ (Markdown: https://insights.sbomify.com/CVE-2026-89630/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-89630
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-89630
- OSV: https://osv.dev/vulnerability/CVE-2026-89630

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-89630/
Summaries are generated and may contain mistakes; the official description above is the record.