Linux Kernel cifs.ko: Heap Out-of-Bounds Write (CVE-2026-89633)

CVE-2026-89633 is a heap out-of-bounds write vulnerability (CWE-787) in the Linux kernel cifs.ko module. The flaw exists in the coalesce_t2() function, which handles SMB1 SMB_COM_TRANSACTION2_SECONDARY responses. A malicious SMB1 server can send responses that trigger a write of 8-byte increments outside the bounds of the server->bigbuf buffer. An attacker can use this primitive to corrupt memory and perform a privilege escalation attack.

Attack Chain

1. The victim client establishes an SMB1 mount to an attacker-controlled server or a machine susceptible to a Man-in-the-Middle (MitM) attack.
2. The client sends a TRANS2 request (e.g., QUERY_FS_INFORMATION).
3. The attacker-controlled server sends a primary response that triggers the large buffer path.
4. The attacker sends multiple SMB_COM_TRANSACTION2_SECONDARY responses.
5. The coalesce_t2() function copies secondary payload data to a destination calculated using an attacker-supplied DataOffset value.
6. The lack of bounds checking on data_area_of_tgt enables an out-of-bounds write relative to the response buffer.
7. The attacker uses the primitive to overwrite the struct cred of a target process on a page-aligned physical memory address.
8. Successful overwrite of the target's UID, GID, and SUIDs to zero results in root-level privilege escalation.

Impact

Successful exploitation allows for arbitrary code execution and privilege escalation to the root user on systems mounting a malicious SMB1 share. The exploit requires an existing SMB1 session and is currently demonstrated as a build-specific research harness.

Recommendation

• Patch the Linux kernel to version 6.12.113 or later, which incorporates the upstream fix 36d01415d881.
• Disable support for the SMB1 protocol (vers=1.0) across all infrastructure to eliminate the attack vector.
• Audit mount configurations on Android and Linux endpoints to ensure that untrusted SMB shares are not automatically mounted.
• Restrict CAP_SYS_ADMIN privileges to prevent unauthorized creation of SMB mounts.