CVE-2026-89633

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

coalesce_t2() computes data pointers directly from server-supplied

DataOffset fields with no validation against buffer bounds:

data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +

get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);

data_area_of_src = (char *)&pSMBs->hdr.Protocol +

get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);

data_area_of_tgt += total_in_tgt;

...

memcpy(data_area_of_tgt, data_area_of_src, total_in_src);

A small DataOffset can push a pointer below the actual byte area,

overwriting header fields; a large one can push it past the buffer

end, causing out-of-bounds heap reads (source) or writes (target).

The BCC overflow guard does not prevent this: BCC reflects how much

data is present, while DataOffset controls where in the buffer it

starts.

The "validate target area" comment pres

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References