CVE-2026-98454

Received Received - Intake

Buffer Overflow in Linux Kernel SMB Client

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes beyond the current context to a handler. The QFid handler also used a full response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same layout assumption: they read LeaseState and LeaseFlags at canonical offsets rather than at DataOffset. A valid non-canonical DataOffset could therefore yield unrelated in-bounds data, while a short DataLength was still accepted. Limit each context to its Next value, reject offsets before the context header, and reject malformed chains. Bound the name range by the current context and do not dispatch a known handler when DataLength is zero. Read the QFid DiskFileId only when the context data covers that field. Parse the lease context from DataOffset and require DataLength to match the v1 or v2 lease_context size used by ksmbd. A size mismatch skips lease parsing without failing the open.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98454

EUVD

EUVD-2026-103694

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	b8c32dbb0deb287a5fcb78251e4eae6c7275760d
Linux	Linux	b8c32dbb0deb287a5fcb78251e4eae6c7275760d
Linux	Linux	b8c32dbb0deb287a5fcb78251e4eae6c7275760d
Linux	Linux	b8c32dbb0deb287a5fcb78251e4eae6c7275760d
Linux	Linux	b8c32dbb0deb287a5fcb78251e4eae6c7275760d
Linux	Linux	3.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of SMB2/SMB3 create contexts. The smb2_parse_contexts() function fails to limit each record to its Next field before processing, allowing malformed chains to expose bytes beyond the current context. Additionally, incorrect parsing of QFid and lease contexts can lead to reading unrelated or out-of-bounds data.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation and requires kernel-level inspection. Detection involves checking kernel logs for SMB-related errors or monitoring network traffic for malformed SMB2/SMB3 create-context chains. Use commands like 'dmesg | grep smb' or 'journalctl -k | grep smb' to review kernel logs for SMB-related errors. Network monitoring tools like Wireshark can analyze SMB traffic for malformed packets.

Impact Analysis

An attacker could exploit this to read sensitive data, cause denial-of-service, or potentially execute arbitrary code by sending malformed SMB2/SMB3 requests. Systems using vulnerable Linux kernel versions with SMB client functionality are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance breaches if sensitive data is exposed due to exploitation of this flaw.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the smb client create context out-of-bounds reads vulnerability. Monitor vendor advisories for kernel updates and apply them promptly.

Hi! I’m here to help you understand CVE-2026-98454. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70