CVE-2026-89634
A critical bug in the Linux kernel’s SMB client could allow an attacker to crash the client or read memory by exploiting an overflow in the ALIGN() function used when handling symlink data. The issue occurs when the error data length is near the maximum 32‑bit value, causing the alignment to wrap to zero and bypass bounds checks. The kernel has been patched to add additional bounds checks before and after alignment.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running SMB client code that has not been updated to include the fix. Any kernel containing the vulnerable code before commit 7d9a7f1f96cd is at risk.
Real-world impact
An attacker could crash the SMB client or read sensitive data from memory, potentially leading to denial of service or information disclosure.
Why this severity
The CVSS score of 9.1 reflects the lack of authentication or user interaction required, the high impact on confidentiality and availability, and the possibility of remote exploitation via SMB.
What to do about it
- 01Upgrade your Linux kernel to a version that includes the fix (commit 7d9a7f1f96cd).
- 02Reboot the system to load the updated kernel.
NVD description
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.