CVE-2026-89794

CVE-2026-89794

published September 16, 2026

CVSS
—
EPSS
0%
Percentile
10.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: zero pipe read compound padding

Compound response handling extends the last response iov to an eight-byte

boundary.

smb2_read_pipe() allocates only the payload size, so the alignment padding

can expose up to seven bytes of uninitialized kernel heap memory.

Allocate the aligned size and clear the unused tail before pinning the

response buffer.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.5th percentile
Published
2026-09-16T15:16Z
References (5)
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 10:30Z
    ksmbd: zero pipe read compound padding
    cvelistv5