CVE-2026-89637 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
A use-after-free vulnerability in the Linux kernel SMB client allows attackers to cause memory corruption or crashes via malformed secondary T2 responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89637?
CVE-2026-89637 is a critical use after free vulnerability in Linux, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
When a valid primary TRANSACT2 response has been received (mid->resp_buf set, mid->multiRsp true) and a subsequent secondary response causes cifs_check_trans2() to return false -- either because the SMB header is invalid (malformed != 0) or because check2ndT2() rejects the PDU -- handle_mid() overwrites mid->resp_buf with the new buffer (leaking the primary buffer) and, because mid->multiRsp is set, skips the server->smallbuf/bigbuf NULL-out. When the user thread frees mid->resp_buf, server->smallbuf or server->bigbuf is left dangling; the demux thread reuses it for the next packet, resulting in a use-after-free.
Combine both early-exit conditions and, when mid->multiRsp is already set, abort the pending transaction inline: set multiEnd, call dequeue_mid() with malformed=true, and return true so handle_mid() exits without touching mid->resp_buf or the server buffer pointers.
Which versions are affected by CVE-2026-89637?
How do I fix CVE-2026-89637?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89637 being exploited?
There is no known exploitation of CVE-2026-89637 in the wild and no public exploit code.
Sources
Also known as AZL-100694, BELL-CVE-2026-89637, DEBIAN-CVE-2026-89637, GHSA-q27p-5553-xhrr, UBUNTU-CVE-2026-89637.