What is the CVSS score of CVE-2026-89631?

CVE-2026-89631 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-89631?

Within 24 hours: identify and inventory all Linux systems with active SMB/CIFS client functionality by checking for mounted CIFS shares (mount | grep cifs) and loaded cifs.ko module; disable non-essential SMB connections or restrict them to trusted internal servers only. Within 7 days: apply the vendor-released security patch to all affected systems and test for stability in a staging environment before production rollout. Within 30 days: verify patch deployment across the entire infrastructure, validate that SMB file shares are functioning correctly, and re-enable any restricted connections that were isolated during remediation.

Linux Kernel CVE-2026-89631

EUVD-2026-76543 CRITICAL

2026-09-11 Linux

GHSA-95qf-fgcq-pcrc

Information Disclosure Linux

9.1

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Lure client to malicious SMB server
Delivery

Client issues SMB1 tree connect
Exploit

Server returns TCON with ByteCount 0/1
Execution

Underflow wraps parser bound
Persist

OOB slab read into nativeFileSystem
Impact

Leaked kernel memory read via /proc/fs/cifs/DebugData

Vulnerability Assessment

Exploitation Conditions	Requires the Linux client to establish an SMB1/CIFS tree connect to an attacker-controlled or compromised SMB server (or a MITM position on the connection); the malicious server returns a TCON response with ByteCount of 0 or 1 to trigger the integer underflow. Exploitation is limited by the need for the victim to mount/connect to that server, use of the SMB1 code path (SMB2/3 mounts are not affected by this TCON parser), and - for the disclosure to reach an attacker - read access to /proc/fs/cifs/DebugData on the client. It is not exploitable against a default host that never mounts an untrusted SMB share.
Impact	The input CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/A:H) overstates real-world exposure. Although the vector is technically network-reachable and unauthenticated at the CIFS-client layer, exploitation requires the victim to mount or connect to an attacker-controlled or compromised SMB server - a meaningful precondition that makes this closer to a client-side/targeted issue than a broadly automatable remote attack. EPSS agrees, at 0.17% (6th percentile), and there is no KEV listing and no public exploit identified. The genuine impact is confidentiality (slab-memory disclosure via /proc), with a plausible availability angle if the oversized read touches an unmapped page and crashes; integrity is unaffected. Net: a real but conditional client-side info-leak, not an internet-facing worm-class flaw - patch on normal kernel cadence, prioritizing hosts that mount untrusted SMB shares.
Exploit ScenarioDerived	An attacker stands up (or compromises) an SMB server and induces a Linux client to connect - for example via a malicious share link, a preconfigured automount, or a hijacked/MITM'd legitimate server. On tree connect, the server returns a TCON response with ByteCount set to 0 or 1, triggering the underflow so the client reads far past the slab allocation and stores the leaked kernel bytes in tcon->nativeFileSystem, which the attacker (or a local user) then reads from /proc/fs/cifs/DebugData. No public exploit is identified at time of analysis, and AC:L implies the crafted response is straightforward to produce once a victim connects.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 13, 2026

Kernel-memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) lets a malicious or compromised SMB server leak up to ~65535 bytes of adjacent slab memory to userspace. CIFSTCon() computes its string-parsing bound from the server-supplied ByteCount minus two; a ByteCount of 0 or 1 underflows to a negative int that converts to a huge size_t and wraps the __u16 bytes_left, so cifs_strndup_from_utf16() reads far past the ~16 KB cifs_req_poolp slab object, and the leaked bytes surface via tcon->nativeFileSystem in /proc/fs/cifs/DebugData. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).

RemediationAI

Vendor-released patch: update to Linux 6.18.51, 7.2.4, or 7.3-rc1 (or the corresponding distribution kernel that backports commits 3be89e80…, 411e484f…, or 65deb183…). The fix rejects a tree-connect byte area smaller than the two bytes the parser minimally consumes. Where immediate patching is not possible, reduce exposure by only mounting SMB shares from trusted servers and avoiding automounts to untrusted or attacker-reachable hosts; if information disclosure is the primary concern, restrict read access to /proc/fs/cifs/DebugData (it is root-readable, so limiting local privileged access reduces the leak surface) - note this does not stop the underlying OOB read, only one exfiltration path. Preferring SMB2/SMB3 mounts (vers=2.0 or higher) avoids the SMB1 TCON path entirely, at the cost of dropping legacy SMB1 server compatibility. Track fixes via https://nvd.nist.gov/vuln/detail/CVE-2026-89631.

Affected VersionsENISA

Linux cc20c031bb067eb3280a1c4b5c42295093e24863 <65deb18359341141d37dc86fc7853511be3c87a7

Linux 2.6.30

Linux patch: 6.18.51

Linux cc20c031bb067eb3280a1c4b5c42295093e24863 <3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d

Linux patch: 0

Linux patch: 7.2.4

Linux cc20c031bb067eb3280a1c4b5c42295093e24863 <411e484fe71a7f1028de617447edad9cb6d9d68a

Linux patch: 7.3-rc1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the in-kernel CIFS/SMB client that mounts remote SMB shares. During tree connect (SMB1 TCON), CIFSTCon() parses the response's byte area to extract strings such as the native file system name. It bounds a strnlen() over that area using the server's ByteCount field minus two; when ByteCount is 0 or 1, the subtraction yields a negative value that, cast to size_t, becomes enormous, and a subsequent subtraction wraps the 16-bit bytes_left counter. That corrupted bound is then passed to cifs_strndup_from_utf16(), producing an out-of-bounds slab read against the ~16 KB cifs_req_poolp allocation. The root cause is a signedness/integer-underflow error (CWE-191) leading to an out-of-bounds read (CWE-125); the input lists CWE as N/A. CPE identifies the affected product only generically as cpe:2.3:a:linux:linux, so version scoping comes from the EUVD/stable-tree data rather than CPE. The bug is long-standing (present since roughly 2.6.30).

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI 7.1 HIGH

Network-delivered by a malicious SMB server the victim must connect to (UI:R), no client auth (PR:N); primary impact is kernel-memory disclosure (C:H) with a possible crash (A:L), no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE 7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Sep 13, 2026 - 07:22 NVD

9.1 (CRITICAL)

Patch available

Sep 11, 2026 - 21:18 EUVD

CVE Published

Sep 11, 2026 - 19:45 cve.org

CRITICAL 9.1

CVE Published

Sep 11, 2026 - 19:45 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject a tree connect response whose byte count is too small

CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData.

Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.

Executive ViewAI

Why It Matters

Linux systems running the SMB/CIFS client are vulnerable to a kernel memory disclosure flaw that allows a malicious SMB server to leak sensitive data from kernel memory to unprivileged userspace, potentially exposing cryptographic material or access credentials. Organizations relying on Linux-to-Windows file sharing infrastructure face credential exposure risk if connected to untrusted or compromised SMB servers.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

High

CIFS client ships in virtually all Linux kernels, widely used for SMB mounts

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-89631 ADVISORY https://ubuntu.com/security/notices/USN-8959-1 ADVISORY https://ubuntu.com/security/notices/USN-8960-1 ADVISORY https://vuldb.com/vuln/402977 REF https://git.kernel.org/stable/c/2ae219762ebac929bf6ab3473681f10ed566af08 REF https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d REF https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a REF https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7 REF https://git.kernel.org/stable/c/bb99866cb1d3d5e8201200a8692fd8da3106a8fd REF https://git.kernel.org/stable/c/d837645a719151ed392d4d9cab4571c2753dab12

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back