CVE-2026-43185
Awaiting Analysis Awaiting Analysis - Queue
Heap Buffer Overflow in Linux Kernel ksmbd

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message. By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow. This fix replaces min_t(int, ...) with min_t(u32)
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-05-07
AI Q&A
2026-05-06
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's ksmbd component, specifically in the smb_direct_prepare_negotiation() function. The issue arises because the function casts unsigned 32-bit values to signed integers before comparing them, which leads to incorrect comparisons when a maliciously crafted preferred_send_size value of 0x80000000 is used.

Due to this incorrect casting, the function incorrectly determines the minimum size, allowing an attacker to set a maximum allowed receive size that is too large. By sending a second message with a size greater than 1420 bytes, the attacker can trigger a heap buffer overflow.

The vulnerability was fixed by replacing the signed integer comparison with an unsigned 32-bit comparison to correctly handle the values.


How can this vulnerability impact me? :

This vulnerability can allow an attacker to cause a heap buffer overflow in the Linux kernel's ksmbd service. A heap buffer overflow can lead to memory corruption, which may be exploited to execute arbitrary code, cause a denial of service (system crash), or escalate privileges on the affected system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart