External risk intelligence

Linux Kernel SMB Client Data Offset Validation Flaw

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-89633

This vulnerability exists in the Linux kernel SMB client code, which processes incoming network traffic from a remote SMB server. While it is network-reachable, typical usage involves a client machine connecting to a file server, and it is not a public-facing service itself, making internet-wide exposure uncommon despite the protocol's network nature.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Linux kernel's SMB client, specifically within the coalesce_t2 function. This flaw allows for out-of-bounds reads or writes by not validating certain offset values provided by a server, potentially leading to data corruption or memory access issues. The main concern is confirming if this specific functionality is in use and exposed within your environment.

Unvalidated server data can corrupt memory.
High impact if the affected code is active.
Confirm relevance and understand your exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic from a remote SMB server to a vulnerable Linux kernel SMB client. This traffic would manipulate data offsets within the SMB protocol to overwrite critical header information or read/write data beyond intended buffer boundaries. This could lead to significant system compromise.

Network-reachable with no authentication.
Triggered by malformed SMB server response.
Leads to severe information disclosure or corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to impact the integrity and confidentiality of data processed by the Linux kernel's SMB client. When processing specific SMB responses from a server, the system might incorrectly calculate data offsets, leading to out-of-bounds reads or writes. This could corrupt memory, potentially affecting system stability or exposing sensitive information that was being processed.

Kernel memory integrity.
Malformed SMB responses.
System instability or data disclosure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's SMB client component. Responsibility for addressing this typically falls to the infrastructure or platform teams managing the affected Linux systems, in coordination with any application owners that rely on SMB services and the vendor management team if a third-party solution is involved. The initial step is to inventory all Linux systems utilizing the SMB client, assess their exposure and criticality, identify the accountable system owners, and then develop a prioritized remediation plan.

Infrastructure/Platform teams own the fix.
Verify SMB client usage and exposure.
Plan and execute kernel updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel SMB client?

It is a foundational software component within the Linux operating system that allows a computer to act as a client, enabling it to mount and access shared files, printers, and resources hosted on remote Windows or Samba-based network servers.

What does CVE-2026-89633 mean?

This is a memory safety issue where the software fails to verify the location of incoming data. Because the system does not check if the provided data offsets are within expected memory boundaries, a malicious or compromised server could trick the kernel into reading from or writing to the wrong memory locations.

How can an attacker trigger this vulnerability?

The issue is triggered by the kernel processing a specially crafted response from an SMB server. It is not triggered by standard, well-formed network traffic. An attacker must be in a position to send these malformed responses to a Linux system actively using the SMB client to mount a remote file share.

Is my system at risk according to Halo Surface Signal?

While the vulnerability is network-reachable, Halo Surface Signal notes that the affected SMB client is typically used to connect outward to a server, rather than acting as a public-facing service itself. Internet-wide exposure is uncommon, but systems that frequently mount file shares from untrusted or high-risk network sources face greater potential relevance.

What should I do to address this vulnerability?

Begin by inventorying your Linux environment to identify which systems are configured to mount SMB shares. Prioritize these systems for kernel updates provided by your Linux distribution vendor, as this fix requires a patch to the core kernel code that manages SMB communications.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.