CVE-2026-98171

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

State: Published
Severity: 8.8 High
Published: Oct 6, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames:

- Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths. - Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject next_cmd values smaller than MID_HEADER_SIZE(server). - Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 1ed29f7a03417b405f38c09cfe04124883127b53Affected b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 7f022867ec9f0166a0b4400385bb601b1c6b2c75Affected b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 72eaef1f37a3b6bec11c342736834dc3707be3e4Affected b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 491e33144dee872cffda207f6fcb09260728f803Affected b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 8749946579708ea0d339034bb7f423a67dbe89cfAffected b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 96c436e4b010711452b2872558938f4ef276492aAffected b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 858d5ac22cb889266993e7670f9f0c4f4aeedd78Affected b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 05762c5bc1cfdcac36747994fde2c04387a457f1Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 1ed29f7a03417b405f38c09cfe04124883127b53Affected
b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 7f022867ec9f0166a0b4400385bb601b1c6b2c75Affected
b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 72eaef1f37a3b6bec11c342736834dc3707be3e4Affected
b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 491e33144dee872cffda207f6fcb09260728f803Affected
b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 8749946579708ea0d339034bb7f423a67dbe89cfAffected
b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 96c436e4b010711452b2872558938f4ef276492aAffected
b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 858d5ac22cb889266993e7670f9f0c4f4aeedd78Affected
b24df3e30cbf48255db866720fb71f14bf9d2f39 to before 05762c5bc1cfdcac36747994fde2c04387a457f1Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.