Smb1 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/smb1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 19:41:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLinux Kernel cifs.ko: Heap Out-of-Bounds Write (CVE-2026-89633)https://feed.craftedsignal.io/briefs/2026-10-cifs-heap-oob/Sat, 31 Oct 2026 19:41:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cifs-heap-oob/A heap out-of-bounds write vulnerability in the Linux kernel SMB1 client allows an attacker-controlled server to overwrite process credentials and escalate privileges to root.CVE-2026-89633 is a heap out-of-bounds write vulnerability (CWE-787) in the Linux kernel cifs.ko module. The flaw exists in the coalesce_t2() function, which handles SMB1 SMB_COM_TRANSACTION2_SECONDARY responses. A malicious SMB1 server can send responses that trigger a write of 8-byte increments outside the bounds of the server->bigbuf buffer. An attacker can use this primitive to corrupt memory and perform a privilege escalation attack.

Attack Chain

  1. The victim client establishes an SMB1 mount to an attacker-controlled server or a machine susceptible to a Man-in-the-Middle (MitM) attack.
  2. The client sends a TRANS2 request (e.g., QUERY_FS_INFORMATION).
  3. The attacker-controlled server sends a primary response that triggers the large buffer path.
  4. The attacker sends multiple SMB_COM_TRANSACTION2_SECONDARY responses.
  5. The coalesce_t2() function copies secondary payload data to a destination calculated using an attacker-supplied DataOffset value.
  6. The lack of bounds checking on data_area_of_tgt enables an out-of-bounds write relative to the response buffer.
  7. The attacker uses the primitive to overwrite the struct cred of a target process on a page-aligned physical memory address.
  8. Successful overwrite of the target's UID, GID, and SUIDs to zero results in root-level privilege escalation.

Impact

Successful exploitation allows for arbitrary code execution and privilege escalation to the root user on systems mounting a malicious SMB1 share. The exploit requires an existing SMB1 session and is currently demonstrated as a build-specific research harness.

Recommendation

  • Patch the Linux kernel to version 6.12.113 or later, which incorporates the upstream fix 36d01415d881.
  • Disable support for the SMB1 protocol (vers=1.0) across all infrastructure to eliminate the attack vector.
  • Audit mount configurations on Android and Linux endpoints to ensure that untrusted SMB shares are not automatically mounted.
  • Restrict CAP_SYS_ADMIN privileges to prevent unauthorized creation of SMB mounts.
]]>criticaladvisorykernelprivilege-escalationsmb1cifscwe-787