{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98454", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.350Z", "datePublished": "2026-10-18T15:15:04.139Z", "dateUpdated": "2026-10-24T14:08:54.144Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:08:54.144Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it. A\nmalformed chain can therefore expose bytes beyond the current context to\na handler. The QFid handler also used a full response-structure cast\nalthough it only reads DiskFileId.\n\nThe SMB2/SMB3 lease parsers made the same layout assumption: they read\nLeaseState and LeaseFlags at canonical offsets rather than at\nDataOffset. A valid non-canonical DataOffset could therefore yield\nunrelated in-bounds data, while a short DataLength was still accepted.\n\nLimit each context to its Next value, reject offsets before the context\nheader, and reject malformed chains. Bound the name range by the current\ncontext and do not dispatch a known handler when DataLength is zero. Read\nthe QFid DiskFileId only when the context data covers that field. Parse the\nlease context from DataOffset and require DataLength to match the v1 or v2\nlease_context size used by ksmbd. A size mismatch skips lease parsing\nwithout failing the open." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - A malicious SMB server supplies the malformed RqLs or QFid chain in an SMB2 CREATE Response over TCP/445; cifs_demultiplex_thread() receives it and cifs_send_recv() returns it through SMB2_open() to the patched smb2_parse_contexts() and its handlers.\nAC:L - The server directly controls Next, DataOffset, DataLength, and the context name; a short final RqLs record deterministically reaches the fixed-layout lease parser without any race or condition outside the attacker's control.\nPR:N - Although SESSION_SETUP and TREE_CONNECT precede SMB2 CREATE, they authenticate the victim client to the server; an attacker operating the SMB endpoint needs no account or privilege on the client host to return the malformed response.\nUI:R - The victim must mount or connect to the attacker's share, or access a mounted path so cifs_open(), cifs_is_path_remote(), or cached-directory handling issues SMB2 CREATE; the server cannot invoke smb2_parse_contexts() unsolicited.\nS:U - The reads and resulting lease or inode state remain within the SMB client kernel's security authority; no VM, IOMMU, or other distinct security boundary is crossed.\nC:H - smb3_parse_lease_buf() can copy 16 bytes beyond a short RqLs record into fid->lease_key; cifs_do_create() can retain it through smb2_set_lease_key(), and a later add_lease_context() returns those adjacent kernel bytes to the server, repeatably exposing heap memory.\nI:N - The vulnerable lease and QFid handlers only read into designated scalar, lease-key, and IndexNumber outputs; they neither overwrite out-of-bounds kernel memory nor provide a write or control-flow primitive.\nA:H - A final RqLs record can contain only its 20-byte header and name while smb3_parse_lease_buf() reads through Epoch at canonical offset 72; placing that record at the response-buffer tail makes the fixed-width loads cross the allocation and can produce a repeatable kernel fault or oops." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/client/smb2ops.c", "fs/smb/client/smb2pdu.c" ], "versions": [ { "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d", "lessThan": "e4c49012708c917eafd9c27054b02d0f8b30fe64", "status": "affected", "versionType": "git" }, { "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d", "lessThan": "28bc9a871799363afa3139e961a8e3684feb8704", "status": "affected", "versionType": "git" }, { "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d", "lessThan": "05a7fd80024ff32b9b40ab1478bb172eeab1c386", "status": "affected", "versionType": "git" }, { "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d", "lessThan": "cecc5399987e73a528ce2b662eeb54af69163cbd", "status": "affected", "versionType": "git" }, { "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d", "lessThan": "67f4c1c6a1b51e203d986779299824d1c2c590a6", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/client/smb2ops.c", "fs/smb/client/smb2pdu.c" ], "versions": [ { "version": "3.7", "status": "affected" }, { "version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.12.112" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.18.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.2.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e4c49012708c917eafd9c27054b02d0f8b30fe64" }, { "url": "https://git.kernel.org/stable/c/28bc9a871799363afa3139e961a8e3684feb8704" }, { "url": "https://git.kernel.org/stable/c/05a7fd80024ff32b9b40ab1478bb172eeab1c386" }, { "url": "https://git.kernel.org/stable/c/cecc5399987e73a528ce2b662eeb54af69163cbd" }, { "url": "https://git.kernel.org/stable/c/67f4c1c6a1b51e203d986779299824d1c2c590a6" } ], "title": "smb: client: fix create context out-of-bounds reads", "x_generator": { "engine": "bippy-1.2.0" } } } }