CVE intelligence

CVE-2026-89631

Vulnerability intelligence

Published Sep 11, 2026Sources checked Oct 30, 2026

9.1CRITICALCVSS out of 10

What this means

Review the available evidence

CVE-2026-89631 and is rated Critical severity with a CVSS score of 9.1. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Sep 24, 2026

Release Notes

CISA KEVNot listedBased on the latest collected catalog

EPSS0.5%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-89631?

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject a tree connect response whose byte count is too small

CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t.

The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData.

Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer.

The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.

Source: NVD