smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-89631

smb: client: reject a tree connect response whose byte count is too small

Answer in brief

CVE-2026-89631 records a Unknown severity vulnerability in smb: client: reject a tree connect response whose byte count is too small. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 11, 2026Updated Sep 11, 2026Source checked Sep 11, 2026First seen by HOL Sep 11, 2026Material review Sep 11, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=cc20c031bb067eb3280a1c4b5c42295093e24863 <3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d \|\| >=cc20c031bb067eb3280a1c4b5c42295093e24863 <411e484fe71a7f1028de617447edad9cb6d9d68a \|\| >=cc20c031bb067eb3280a1c4b5c42295093e24863 <65deb18359341141d37dc86fc7853511be3c87a7	3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d, 411e484fe71a7f1028de617447edad9cb6d9d68a, 65deb18359341141d37dc86fc7853511be3c87a7
Linux/Linuxgeneric	2.6.30	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 11, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData. Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.

Quoted source text, attributed separately from HOL analysis.