CVE-2026-98405

Received Received - Intake

Buffer Overflow in Linux Kernel SMB Client

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len). If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory. Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98405

EUVD

EUVD-2026-101054

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	a90f37e3d7acfd9824f162830583bbf7846fe252
Linux	Linux	a90f37e3d7acfd9824f162830583bbf7846fe252
Linux	Linux	a90f37e3d7acfd9824f162830583bbf7846fe252
Linux	Linux	a90f37e3d7acfd9824f162830583bbf7846fe252
Linux	Linux	a90f37e3d7acfd9824f162830583bbf7846fe252
Linux	Linux	6.6.32
Linux	Linux	6.6.32
Linux	Linux	6.6.32
Linux	Linux	6.6.32
Linux	Linux	6.6.32

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in the Linux kernel's SMB client implementation. It involves a missing bounds check in the parse_posix_sids() function. A malicious SMB server could send a response with an inflated length value, causing the function to read beyond the allocated memory buffer. This leads to out-of-bounds memory access in the kernel.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version and compare it against patched versions. No direct network detection commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker on the same network to potentially execute arbitrary code or cause a kernel crash by sending specially crafted SMB responses. It may lead to privilege escalation, data corruption, or denial of service on affected Linux systems.

Compliance Impact

This vulnerability involves out-of-bounds memory reads in the Linux kernel's SMB client due to missing bounds checks. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety.

Mitigation Strategies

Apply the latest kernel security updates from your Linux distribution. If updates are unavailable, consider disabling SMB client functionality or restricting SMB connections to trusted servers until patched.

Hi! I’m here to help you understand CVE-2026-98405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70