{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/linux-kernel--6.12.113/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-89633"},{"id":"CVE-2026-98937"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux Kernel (\u003c 6.12.113)","Linux Kernel (\u003c 6.12.113, \u003c 6.18.56, \u003c 7.2.10)"],"_cs_severities":["critical"],"_cs_tags":["kernel","privilege-escalation","smb1","cifs","cwe-787"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-89633 is a heap out-of-bounds write vulnerability (CWE-787) in the Linux kernel \u003ccode\u003ecifs.ko\u003c/code\u003e module. The flaw exists in the \u003ccode\u003ecoalesce_t2()\u003c/code\u003e function, which handles SMB1 \u003ccode\u003eSMB_COM_TRANSACTION2_SECONDARY\u003c/code\u003e responses. A malicious SMB1 server can send responses that trigger a write of 8-byte increments outside the bounds of the \u003ccode\u003eserver-\u0026gt;bigbuf\u003c/code\u003e buffer. An attacker can use this primitive to corrupt memory and perform a privilege escalation attack.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe victim client establishes an SMB1 mount to an attacker-controlled server or a machine susceptible to a Man-in-the-Middle (MitM) attack.\u003c/li\u003e\n\u003cli\u003eThe client sends a TRANS2 request (e.g., \u003ccode\u003eQUERY_FS_INFORMATION\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled server sends a primary response that triggers the large buffer path.\u003c/li\u003e\n\u003cli\u003eThe attacker sends multiple \u003ccode\u003eSMB_COM_TRANSACTION2_SECONDARY\u003c/code\u003e responses.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ecoalesce_t2()\u003c/code\u003e function copies secondary payload data to a destination calculated using an attacker-supplied \u003ccode\u003eDataOffset\u003c/code\u003e value.\u003c/li\u003e\n\u003cli\u003eThe lack of bounds checking on \u003ccode\u003edata_area_of_tgt\u003c/code\u003e enables an out-of-bounds write relative to the response buffer.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the primitive to overwrite the \u003ccode\u003estruct cred\u003c/code\u003e of a target process on a page-aligned physical memory address.\u003c/li\u003e\n\u003cli\u003eSuccessful overwrite of the target's UID, GID, and SUIDs to zero results in root-level privilege escalation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution and privilege escalation to the root user on systems mounting a malicious SMB1 share. The exploit requires an existing SMB1 session and is currently demonstrated as a build-specific research harness.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch the Linux kernel to version 6.12.113 or later, which incorporates the upstream fix \u003ccode\u003e36d01415d881\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDisable support for the SMB1 protocol (\u003ccode\u003evers=1.0\u003c/code\u003e) across all infrastructure to eliminate the attack vector.\u003c/li\u003e\n\u003cli\u003eAudit mount configurations on Android and Linux endpoints to ensure that untrusted SMB shares are not automatically mounted.\u003c/li\u003e\n\u003cli\u003eRestrict \u003ccode\u003eCAP_SYS_ADMIN\u003c/code\u003e privileges to prevent unauthorized creation of SMB mounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T22:44:12Z","date_published":"2026-10-31T19:41:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cifs-heap-oob/","summary":"A heap out-of-bounds write vulnerability in the Linux kernel SMB1 client allows an attacker-controlled server to overwrite process credentials and escalate privileges to root.","title":"Linux Kernel cifs.ko: Heap Out-of-Bounds Write (CVE-2026-89633)","url":"https://feed.craftedsignal.io/briefs/2026-10-cifs-heap-oob/"}],"language":"en","title":"CraftedSignal Threat Feed - Linux Kernel (\u003c 6.12.113)","version":"https://jsonfeed.org/version/1.1"}