CVE-2026-89630

Last refreshed2026-10-11

Status: UPDATED | Advisory ID: CVE-2026-89630

Key Details

CVE	CVE-2026-89630
CVSS Score / Version	9.1 (Critical) / CVSS v3.1
Updated	2026-10-11
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is none; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restore the data_offset bound in is_valid_oplock_break()

Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")

changed the quantity this bound is measured against. It used to be

srv->total_read minus the 4-byte RFC1002 preamble that total_read then

included, so it was the SMB message length. The same commit stopped

counting the preamble, and the mechanical substitution to

srv->total_read - srv->pdu_size left an expression that is identically

zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly

pdu_length - MID_HEADER_SIZE() more, adding both to total_read.

len is therefore 0, the subtraction below it wraps, and no __u32

DataOffset can exceed the result, so the check from commit 097f5863b1a0

("cifs: read overflow in is_valid_oplock_break()") no longer rejects

anything. Use total_read, which is now the message length on its own. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-89630
CVE	https://www.cve.org/CVERecord?id=CVE-2026-89630

Source

Reference

NVD

CVE