{"id":"CVE-2026-89632","summary":"smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()\n\nreparse_buf_ptr() reads buf-\u003eReparseDataLength before checking that\ncount covers the full fixed header:\n\n    buf = (struct reparse_data_buffer *)((u8 *)io + off);\n    len = sizeof(*buf);                          /* 8 bytes */\n    rdlen = le16_to_cpu(buf-\u003eReparseDataLength); /* offset 4, 2 bytes */\n\n    if (count \u003c len || count \u003c rdlen + len)      /* check comes after */\n\nstruct reparse_data_buffer has ReparseDataLength at offset 4.  If a\nserver returns OutputCount \u003c 6, the read at offset 4-5 reaches past\nthe end of the received data.  The off+count bounds against iov_len\nwere already validated, but that does not protect against count being\nsmaller than sizeof(*buf).\n\nSplit the check: verify count \u003e= sizeof(*buf) before reading\nReparseDataLength, then verify count covers the data region.","modified":"2026-09-13T03:47:20.171558781Z","published":"2026-09-11T19:45:27.325Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89632.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/711cf71300d7992f450600df8864917d3538679f"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89632.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89632"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a158bb66b1373866d9fd5997565a58a573085539"},{"fixed":"711cf71300d7992f450600df8864917d3538679f"},{"fixed":"05f78e6cf34ea3a285053bd5999e08e8ac298bd5"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89632.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.32"},{"fixed":"7.2.4"},{"fixed":"7.3-rc1"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89632.json"}}],"schema_version":"1.9.0"}