CVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restore the dataoffset bound in isvalidoplockbreak()

Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr")

changed the quantity this bound is measured against.  It used to be

srv->totalread minus the 4-byte RFC1002 preamble that totalread then

included, so it was the SMB message length.  The same commit stopped

counting the preamble, and the mechanical substitution to

srv->totalread - srv->pdusize left an expression that is identically

zero: standardreceive3() reads MIDHEADER_SIZE() bytes and then exactly

pdulength - MIDHEADERSIZE() more, adding both to totalread.

len is therefore 0, the subtraction below it wraps, and no __u32

DataOffset can exceed the result, so the check from commit 097f5863b1a0

("cifs: read overflow in isvalidoplock_break()") no longer rejects

anything.  Use total_read, which is now the message length on its own.