CVE-2026-98405

smb: client: fix missing iov bounds check in parse_posix_sids()

State: Published
Severity: 8.1 High
Published: Oct 14, 2026
Updated: Oct 24, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix missing iov bounds check in parse_posix_sids()

In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len).

If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory.

Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a90f37e3d7acfd9824f162830583bbf7846fe252 to before d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644Affected 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to before b862996e5105be1293da9cdc85da77b76021c3bdAffected 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to before 2f8ed71aaaba3bc8b19cd9930cc62e63e142b299Affected 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to before eac6917a42899aad0617bbf04798c5dd946a1fe5Affected 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to before b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dcAffected 6.6.32 to before 6.6.158Affected
LinuxLinux	6.8Affected before 6.8Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

a90f37e3d7acfd9824f162830583bbf7846fe252 to before d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644Affected
858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to before b862996e5105be1293da9cdc85da77b76021c3bdAffected
858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to before 2f8ed71aaaba3bc8b19cd9930cc62e63e142b299Affected
858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to before eac6917a42899aad0617bbf04798c5dd946a1fe5Affected
858e74876c5cbff1dfd5bace99e32fbce2abd4b5 to before b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dcAffected
6.6.32 to before 6.6.158Affected

LinuxLinux

6.8Affected
before 6.8Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.