CVE-2026-89794 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: zero pipe read compound padding
Compound response handling extends the last response iov to an eight-byte boundary.
smb2_read_pipe() allocates only the payload size, so the alignment padding can expose up to seven bytes of uninitialized kernel heap memory.
Allocate the aligned size and clear the unused tail before pinning the response buffer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in the Linux kernel's ksmbd module represents a critical information disclosure flaw rooted in improper handling of compound SMB2 read operations involving pipes. The Common Weakness Enumeration (CWE) classifies this issue under CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor, and specifically relates to CWE-1341 where memory is not properly initialized before being exposed or transmitted over a network interface. This flaw emerges from the architectural design of how compound responses are processed within the server implementation, where protocol compliance dictates that response data structures must be aligned to specific byte boundaries for efficient processing by client systems.
During the execution of an SMB2 read pipe operation, the kernel allocates memory buffers based strictly on the calculated payload size required for the immediate transaction. However, the compound response handling mechanism subsequently extends this last response input/output vector (iov) to satisfy an eight-byte alignment boundary requirement inherent in the protocol specification. Because the initial allocation did not account for this padding extension, the additional bytes added to reach the aligned size remain uninitialized within the kernel heap memory space. When these buffers are prepared for transmission or further processing, they contain residual data from previous allocations that were never cleared, creating a direct pathway for sensitive internal state information to leak out of the secure kernel boundary into untrusted network traffic.
The operational impact of this vulnerability is significant as it allows an authenticated attacker who can initiate SMB2 read pipe requests to potentially extract up to seven bytes of uninitialized kernel heap memory per request. While the volume of data exposed in a single transaction is small, the ability to repeatedly trigger this condition enables systematic reconnaissance and potential exploitation scenarios where attackers might correlate leaked memory contents with known structures or keys within the host system. This undermines the confidentiality guarantees provided by the operating system's memory management subsystem and violates the principle of least privilege regarding kernel heap isolation. The vulnerability falls under MITRE ATT&CK technique T1074, specifically Data Staged for Exfiltration via Local Processes, as it involves staging sensitive data in a buffer that is subsequently transmitted over the network interface without proper sanitization.
To mitigate this risk, the ksmbd implementation was updated to ensure that memory allocations strictly match the aligned size requirements of the compound response structure rather than just the payload size. Furthermore, critical remediation steps include explicitly clearing or zeroing out any unused tail bytes in the buffer before pinning it for network transmission. This ensures that no residual heap data is inadvertently included in the final packet sent to clients. System administrators should apply the latest kernel updates provided by their distribution vendors immediately to patch this flaw and prevent potential information leakage through SMB2 pipe read operations.