In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_data() error context loop The check… (CVE-2026-89634)
A vulnerability in the Linux kernel SMB client was resolved that involved an overflow in the ALIGN() macro within the symlink_data() error context loop. The issue allowed an overflow when processing ErrorDataLength values near UINT32_MAX, causing the ALIGN() calculation to wrap to zero and bypass bounds checks. This could lead to an infinite loop or out-of-bounds read. The fix involves adding checks on the raw ErrorDataLength before and after alignment to prevent overflow and ensure proper bounds validation.
AI Analysis
Technical Summary
The Linux kernel SMB client had a vulnerability in the symlink_data() function where the ALIGN() macro could overflow when handling large ErrorDataLength values close to UINT32_MAX. This overflow caused the bounds check to incorrectly pass, allowing the loop to advance by zero bytes repeatedly, potentially resulting in an infinite loop or out-of-bounds read. The patch fixes this by first validating the raw ErrorDataLength against the buffer size before applying ALIGN(), and then performing a second bounds check after alignment. This ensures that the length calculations do not overflow and that the loop progresses correctly.
Potential Impact
The vulnerability could cause an infinite loop or out-of-bounds memory read in the SMB client code of the Linux kernel when processing specially crafted error data. This may lead to denial of service or memory corruption. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been applied to the Linux kernel to address this vulnerability by improving bounds checking around the ALIGN() macro usage in symlink_data(). Users should update to a Linux kernel version that includes this fix. No additional mitigations are specified.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_data() error context loop The check… (CVE-2026-89634)
Description
A vulnerability in the Linux kernel SMB client was resolved that involved an overflow in the ALIGN() macro within the symlink_data() error context loop. The issue allowed an overflow when processing ErrorDataLength values near UINT32_MAX, causing the ALIGN() calculation to wrap to zero and bypass bounds checks. This could lead to an infinite loop or out-of-bounds read. The fix involves adding checks on the raw ErrorDataLength before and after alignment to prevent overflow and ensure proper bounds validation.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel SMB client had a vulnerability in the symlink_data() function where the ALIGN() macro could overflow when handling large ErrorDataLength values close to UINT32_MAX. This overflow caused the bounds check to incorrectly pass, allowing the loop to advance by zero bytes repeatedly, potentially resulting in an infinite loop or out-of-bounds read. The patch fixes this by first validating the raw ErrorDataLength against the buffer size before applying ALIGN(), and then performing a second bounds check after alignment. This ensures that the length calculations do not overflow and that the loop progresses correctly.
Potential Impact
The vulnerability could cause an infinite loop or out-of-bounds memory read in the SMB client code of the Linux kernel when processing specially crafted error data. This may lead to denial of service or memory corruption. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been applied to the Linux kernel to address this vulnerability by improving bounds checking around the ALIGN() macro usage in symlink_data(). Users should update to a Linux kernel version that includes this fix. No additional mitigations are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-959h-4fxq-gqhj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89634"]
Threat ID: 6aa4a00955bf5e2cf5a8665d
Added to database: 09/12/2026, 00:42:49 UTC
Last enriched: 09/12/2026, 01:01:11 UTC
Last updated: 09/12/2026, 01:01:11 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.