CVE-2026-72310
Received Received - Intake

SMB Client Passthrough IOCTL Bounds Check Overflow

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds check currently adds OutputOffset and qi.input_buffer_length directly, so the addition can wrap in 32-bit arithmetic before the result is compared against the response buffer length. A malicious server can use a large OutputOffset and a small OutputCount to make the wrapped sum pass the bounds check. The later copy_to_user() then reads from io_rsp + OutputOffset, outside the response buffer. Use size_add() for the offset plus length check so overflow is treated as out of bounds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72310
EUVD
EUVD-2026-59209

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves an overflow in the SMB client's passthrough ioctl bounds check. The issue occurs in smb2_ioctl_query_info() where a malicious SMB server can exploit 32-bit field values to bypass buffer length checks. By setting a large OutputOffset and small OutputCount, the sum wraps around in 32-bit arithmetic, making the check pass. This allows reading outside the intended response buffer during copy_to_user().

Detection Guidance

This vulnerability is specific to the Linux kernel's SMB client implementation. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version and compare it against patched versions. No direct network detection commands are provided in the context.

Impact Analysis

If you use a Linux system with SMB client functionality, a malicious SMB server could potentially read or write memory outside the expected buffer. This might lead to crashes, data corruption, or unauthorized access to sensitive information on your system.

Mitigation Strategies

Immediately update your Linux kernel to the latest patched version. If updating is not immediately possible, consider disabling SMB client functionality or restricting access to untrusted SMB servers until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart