In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed… (CVE-2026-89637)
A use-after-free (UAF) and buffer leak vulnerability in the Linux kernel SMB client was resolved. The flaw occurs in the cifs_check_trans2() function when handling malformed secondary TRANSACT2 responses, leading to improper buffer management and potential memory corruption. The issue arises when a valid primary response buffer is overwritten without freeing, causing dangling pointers and reuse of freed memory. The fix aborts the pending transaction early to prevent buffer misuse.
AI Analysis
Technical Summary
This vulnerability in the Linux kernel SMB client involves a use-after-free and buffer leak in the cifs_check_trans2() function. When a valid primary TRANSACT2 response is followed by a malformed secondary response, the function handle_mid() incorrectly overwrites the primary response buffer without freeing it, leaking memory. Additionally, because mid->multiRsp is set, server buffer pointers are left dangling, and subsequent reuse by the demux thread causes a use-after-free condition. The patch aborts the transaction early by setting multiEnd, calling dequeue_mid() with malformed=true, and returning true to prevent handle_mid() from modifying buffers improperly.
Potential Impact
The vulnerability can lead to use-after-free conditions and buffer leaks in the Linux kernel SMB client, potentially causing memory corruption or instability. No active exploits are known in the wild. The impact is limited to SMB client operations involving malformed secondary TRANSACT2 responses.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by aborting malformed transactions early and preventing improper buffer handling. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed… (CVE-2026-89637)
Description
A use-after-free (UAF) and buffer leak vulnerability in the Linux kernel SMB client was resolved. The flaw occurs in the cifs_check_trans2() function when handling malformed secondary TRANSACT2 responses, leading to improper buffer management and potential memory corruption. The issue arises when a valid primary response buffer is overwritten without freeing, causing dangling pointers and reuse of freed memory. The fix aborts the pending transaction early to prevent buffer misuse.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in the Linux kernel SMB client involves a use-after-free and buffer leak in the cifs_check_trans2() function. When a valid primary TRANSACT2 response is followed by a malformed secondary response, the function handle_mid() incorrectly overwrites the primary response buffer without freeing it, leaking memory. Additionally, because mid->multiRsp is set, server buffer pointers are left dangling, and subsequent reuse by the demux thread causes a use-after-free condition. The patch aborts the transaction early by setting multiEnd, calling dequeue_mid() with malformed=true, and returning true to prevent handle_mid() from modifying buffers improperly.
Potential Impact
The vulnerability can lead to use-after-free conditions and buffer leaks in the Linux kernel SMB client, potentially causing memory corruption or instability. No active exploits are known in the wild. The impact is limited to SMB client operations involving malformed secondary TRANSACT2 responses.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to address this vulnerability by aborting malformed transactions early and preventing improper buffer handling. Users should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-q27p-5553-xhrr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89637"]
Threat ID: 6aa4a00855bf5e2cf5a8664f
Added to database: 09/12/2026, 00:42:48 UTC
Last enriched: 09/12/2026, 01:00:13 UTC
Last updated: 09/12/2026, 01:00:13 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.