---
id: CVE-2026-89794
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: zero pipe read compound padding

  Compound response handling extends the last response iov to an eight-byte
  boundary.

  smb2_read_pipe() allocates only the payload…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: zero pipe read compound padding

  Compound response handling extends the last response iov to an eight-byte
  boundary.

  smb2_read_pipe() allocates only the payload…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d <
    f188a400dd5285fec5a84548fe8dca49eee01155
  - >-
    Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d <
    d83a9de7cecd401c3d3e00ed6371194dcd7313e4
  - >-
    Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d <
    be15b8da4a82cf1e1f9880b2661b90770606eec1
  - >-
    Linux >= e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d <
    73f860489e3be2245598d1819226304fc5b87291
  - Linux f2283680a80571ca82d710bc6ecd8f8beac67d63
  - Linux 9f297df20d93411c0b4ddad7f88ba04a7cd36e77
  - Linux >= 5.15.145 < 5.16
  - Linux >= 6.1.71 < 6.2
  - Linux 6.6
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T11:16:44.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89794'
references:
  - url: 'https://git.kernel.org/stable/c/73f860489e3be2245598d1819226304fc5b87291'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/be15b8da4a82cf1e1f9880b2661b90770606eec1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d83a9de7cecd401c3d3e00ed6371194dcd7313e4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f188a400dd5285fec5a84548fe8dca49eee01155'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:54.011Z'
epss: 0.00209
epssPercentile: 0.09796
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: zero pipe read compound padding

Compound response handling extends the last response iov to an eight-byte
boundary.

smb2_read_pipe() allocates only the payload size, so the alignment padding
can expose up to seven bytes of uninitialized kernel heap memory.

Allocate the aligned size and clear the unused tail before pinning the
response buffer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.