CVE-2026-98170

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds. Fix this by ensuring src_size >= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer. Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating "attribute not present" or "output buffer too small".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98170

EUVD

EUVD-2026-93098

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	95907fea4fd8ccc736e0a428e52159b4d42b9958
Linux	Linux	95907fea4fd8ccc736e0a428e52159b4d42b9958
Linux	Linux	95907fea4fd8ccc736e0a428e52159b4d42b9958
Linux	Linux	95907fea4fd8ccc736e0a428e52159b4d42b9958
Linux	Linux	4.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the SMB (Server Message Block) client implementation. Specifically, in the function move_smb2_ea_to_cifs(), the loop condition while (src_size > 0) allows iteration even when the remaining buffer size is too small to hold a complete smb2_ea_info structure. This leads to out-of-bounds reads of fields like ea_name_length and ea_value_length.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and may not have direct network detection commands. Monitor kernel logs for errors related to SMB operations or EA (Extended Attribute) handling. Check for crashes or unexpected behavior when accessing SMB shares.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data or cause system instability if a malicious SMB server sends malformed Extended Attribute (EA) data. It may lead to crashes or unauthorized information disclosure on systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to memory safety in SMB client operations. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this issue. Avoid using SMB shares from untrusted servers until patched. If immediate patching is not possible, restrict access to SMB shares or disable SMB client functionality temporarily.

Hi! I’m here to help you understand CVE-2026-98170. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70