{"id":"CVE-2026-89794","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: zero pipe read compound padding\n\nCompound response handling extends the last response iov to an eight-byte\nboundary.\n\nsmb2_read_pipe() allocates only the payload…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: zero pipe read compound padding\n\nCompound response handling extends the last response iov to an eight-byte\nboundary.\n\nsmb2_read_pipe() allocates only the payload…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < f188a400dd5285fec5a84548fe8dca49eee01155","Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < d83a9de7cecd401c3d3e00ed6371194dcd7313e4","Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < be15b8da4a82cf1e1f9880b2661b90770606eec1","Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d < 73f860489e3be2245598d1819226304fc5b87291","Linux f2283680a80571ca82d710bc6ecd8f8beac67d63","Linux 9f297df20d93411c0b4ddad7f88ba04a7cd36e77","Linux >= 5.15.145 < 5.16","Linux >= 6.1.71 < 6.2","Linux 6.6"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T11:16:44.197","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89794","references":[{"url":"https://git.kernel.org/stable/c/73f860489e3be2245598d1819226304fc5b87291","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be15b8da4a82cf1e1f9880b2661b90770606eec1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d83a9de7cecd401c3d3e00ed6371194dcd7313e4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f188a400dd5285fec5a84548fe8dca49eee01155","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-16T10:53:54.011Z","epss":0.002,"epssPercentile":0.10169,"slug":"CVE-2026-89794","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: zero pipe read compound padding\n\nCompound response handling extends the last response iov to an eight-byte\nboundary.\n\nsmb2_read_pipe() allocates only the payload size, so the alignment padding\ncan expose up to seven bytes of uninitialized kernel heap memory.\n\nAllocate the aligned size and clear the unused tail before pinning the\nresponse buffer.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}