CVE-2026-97563
Received Received - Intake

Buffer Overflow in Linux Kernel SMB Client

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() The SMB1 synchronous read helper CIFSSMBRead() validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy source is formed as &pSMBr->hdr.Protocol + le16_to_cpu(pSMBr->DataOffset) and memcpy()'d for DataLength bytes with no check that the [DataOffset, DataOffset + DataLength) range lies within the response actually received from the server. A malicious or compromised SMB1 server can return a response carrying an in-range DataLength and a large DataOffset, driving the source pointer past the end of the response buffer. The memcpy() then copies adjacent kernel heap into the caller's read buffer (information disclosure), or reads unmapped memory and oopses (denial of service). SMB1 is not negotiated by default; reaching this code requires an explicit vers=1.0 mount. Both DataOffset and the received response length recorded in rsp_iov.iov_len are relative to the start of the SMB header, so reject the response unless DataOffset + DataLength fits within that length, using overflow-safe arithmetic, before forming the source pointer. The response length has been validated by the previous patch, so the DataOffset and DataLength fields can be read safely here. While here, make data_length unsigned. It holds a length derived from unsigned on-the-wire fields and is only ever compared against unsigned quantities; print it with %u accordingly, and add __func__ to the cifs_dbg() calls in this function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97563
EUVD
EUVD-2026-86871

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the SMB1 synchronous read function CIFSSMBRead(). The function fails to validate the DataOffset field in server responses, allowing a malicious server to provide a large DataOffset value. This can cause the function to read beyond the allocated response buffer, leading to either information disclosure by copying adjacent kernel memory into the read buffer or a denial of service by accessing unmapped memory.

Detection Guidance

This vulnerability is specific to SMB1 protocol usage with explicit vers=1.0 mounts in Linux kernel. Detection involves checking for SMB1 mounts and validating kernel versions. Use commands like 'mount | grep vers=1.0' to identify SMB1 mounts and 'uname -a' to check kernel version. Ensure your kernel is updated to a patched version.

Impact Analysis

If you are using a Linux system with SMB1 explicitly enabled (vers=1.0 mount), a malicious or compromised SMB server could exploit this flaw to read sensitive kernel memory or crash your system. This could result in unauthorized data access or system instability. Most modern systems do not use SMB1 by default, reducing exposure.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using SMB1 with affected Linux kernels may face compliance risks if exploited, potentially resulting in data breaches or system failures.

Mitigation Strategies

Immediately stop using SMB1 protocol by remounting shares with vers=2.0 or higher. Update your Linux kernel to the latest patched version. If SMB1 is required, ensure it is only used in trusted networks and monitor for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97563. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart