CVE-2026-89792ksmbd: prevent out-of-bounds reads in share config responses
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configuration payload sizes before consuming variable-length fields. Bound veto list parsing and account for the separator byte when deriving the path length.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 88b7f1143b15b29cccb8392b4f38e75b7bb3e300 before df8aa4a09733c4d3974b1db32c1782b3aad3a151; from 51a6c2af9d20203ddeeaf73314ba8854b38d01bd before 0127f1c119bde40578f4d25f5d17333b4e75de8c; from a637fabac554270a851033f5ab402ecb90bc479c before fd636a87161def6e35876ab7943641ce457974c8; from a677ebd8ca2f2632ccdecbad7b87641274e15aac before ffa507f5f774cb4d45136b106989ebc051361263; from a677ebd8ca2f2632ccdecbad7b87641274e15aac before cd2bcee450bc94770be56c0b896c1a1dc6838bd8; from a677ebd8ca2f2632ccdecbad7b87641274e15aac before 61a8d06600c8c397f9a7e01940479d4c94a82f5f; from a677ebd8ca2f2632ccdecbad7b87641274e15aac before f25e93768fcc5d8287e50b1ec52a42e4c276df34; 76af689a45aa44714b46d1a7de4ffdf851ded896; and 4 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/df8aa4a09733c4d3974b1db32c1782b3aad3a151
- https://git.kernel.org/stable/c/0127f1c119bde40578f4d25f5d17333b4e75de8c
- https://git.kernel.org/stable/c/fd636a87161def6e35876ab7943641ce457974c8
- https://git.kernel.org/stable/c/ffa507f5f774cb4d45136b106989ebc051361263
- https://git.kernel.org/stable/c/cd2bcee450bc94770be56c0b896c1a1dc6838bd8
- https://git.kernel.org/stable/c/61a8d06600c8c397f9a7e01940479d4c94a82f5f
- https://git.kernel.org/stable/c/f25e93768fcc5d8287e50b1ec52a42e4c276df34
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.