Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-98405

smb: client: fix missing iov bounds check in parse_posix_sids()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len). If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory. Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • a90f37e3d7acfd9824f162830583bbf7846fe252 to < d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644affected
  • 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to < b862996e5105be1293da9cdc85da77b76021c3bdaffected
  • 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to < 2f8ed71aaaba3bc8b19cd9930cc62e63e142b299affected
  • 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to < eac6917a42899aad0617bbf04798c5dd946a1fe5affected
  • 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to < b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dcaffected
  • 6.6.32 to < 6.6.158affected

Linux Linux

Default version status: affected

  • 6.8affected
  • 0 to < 6.8unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.54 to ≤ 6.18.*unaffected
  • 7.2.8 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References