Vulnerability details
CVE-2026-98405
Linux Linux
smb: client: fix missing iov bounds check in parse_posix_sids()
CVSS 3.1
8.1High
Official description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len). If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory. Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (Linux) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Linux | Linux | 6.8 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 6.6.32 ≤ v < 6.6.158 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 ≤ v < 2f8ed71aaaba3bc8b19cd9930cc62e63e142b299 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 ≤ v < b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 ≤ v < eac6917a42899aad0617bbf04798c5dd946a1fe5 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 ≤ v < b862996e5105be1293da9cdc85da77b76021c3bd | CVEProject cvelistV5 (CNA) |
| Linux | Linux | a90f37e3d7acfd9824f162830583bbf7846fe252 ≤ v < d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://git.kernel.org/stable/c/d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644
- https://git.kernel.org/stable/c/b862996e5105be1293da9cdc85da77b76021c3bd
- https://git.kernel.org/stable/c/2f8ed71aaaba3bc8b19cd9930cc62e63e142b299
- https://git.kernel.org/stable/c/eac6917a42899aad0617bbf04798c5dd946a1fe5
- https://git.kernel.org/stable/c/b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-14
- Last updated
- 2026-10-24
- State
- Published
- Assigner (CNA)
- Linux
Exploit prediction (EPSS)
0.47%
Probability of exploitation in 30 days
41.5%
Percentile (among all CVEs)
Weaknesses (CWE)
- —