CVE-2026-98454 (GCVE-0-2026-98454)
Vulnerability from cvelistv5
Published
2026-10-18 15:15
Modified
2026-10-24 14:08
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes beyond the current context to a handler. The QFid handler also used a full response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same layout assumption: they read LeaseState and LeaseFlags at canonical offsets rather than at DataOffset. A valid non-canonical DataOffset could therefore yield unrelated in-bounds data, while a short DataLength was still accepted. Limit each context to its Next value, reject offsets before the context header, and reject malformed chains. Bound the name range by the current context and do not dispatch a known handler when DataLength is zero. Read the QFid DiskFileId only when the context data covers that field. Parse the lease context from DataOffset and require DataLength to match the v1 or v2 lease_context size used by ksmbd. A size mismatch skips lease parsing without failing the open.
References
Impacted products
Vendor Product Version
Linux Linux Version: b8c32dbb0deb287a5fcb78251e4eae6c7275760d
Version: b8c32dbb0deb287a5fcb78251e4eae6c7275760d
Version: b8c32dbb0deb287a5fcb78251e4eae6c7275760d
Version: b8c32dbb0deb287a5fcb78251e4eae6c7275760d
Version: b8c32dbb0deb287a5fcb78251e4eae6c7275760d
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c",
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e4c49012708c917eafd9c27054b02d0f8b30fe64",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            },
            {
              "lessThan": "28bc9a871799363afa3139e961a8e3684feb8704",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            },
            {
              "lessThan": "05a7fd80024ff32b9b40ab1478bb172eeab1c386",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            },
            {
              "lessThan": "cecc5399987e73a528ce2b662eeb54af69163cbd",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            },
            {
              "lessThan": "67f4c1c6a1b51e203d986779299824d1c2c590a6",
              "status": "affected",
              "version": "b8c32dbb0deb287a5fcb78251e4eae6c7275760d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c",
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it.  A\nmalformed chain can therefore expose bytes beyond the current context to\na handler.  The QFid handler also used a full response-structure cast\nalthough it only reads DiskFileId.\n\nThe SMB2/SMB3 lease parsers made the same layout assumption: they read\nLeaseState and LeaseFlags at canonical offsets rather than at\nDataOffset.  A valid non-canonical DataOffset could therefore yield\nunrelated in-bounds data, while a short DataLength was still accepted.\n\nLimit each context to its Next value, reject offsets before the context\nheader, and reject malformed chains.  Bound the name range by the current\ncontext and do not dispatch a known handler when DataLength is zero.  Read\nthe QFid DiskFileId only when the context data covers that field.  Parse the\nlease context from DataOffset and require DataLength to match the v1 or v2\nlease_context size used by ksmbd.  A size mismatch skips lease parsing\nwithout failing the open."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious SMB server supplies the malformed RqLs or QFid chain in an SMB2 CREATE Response over TCP/445; cifs_demultiplex_thread() receives it and cifs_send_recv() returns it through SMB2_open() to the patched smb2_parse_contexts() and its handlers.\nAC:L - The server directly controls Next, DataOffset, DataLength, and the context name; a short final RqLs record deterministically reaches the fixed-layout lease parser without any race or condition outside the attacker\u0027s control.\nPR:N - Although SESSION_SETUP and TREE_CONNECT precede SMB2 CREATE, they authenticate the victim client to the server; an attacker operating the SMB endpoint needs no account or privilege on the client host to return the malformed response.\nUI:R - The victim must mount or connect to the attacker\u0027s share, or access a mounted path so cifs_open(), cifs_is_path_remote(), or cached-directory handling issues SMB2 CREATE; the server cannot invoke smb2_parse_contexts() unsolicited.\nS:U - The reads and resulting lease or inode state remain within the SMB client kernel\u0027s security authority; no VM, IOMMU, or other distinct security boundary is crossed.\nC:H - smb3_parse_lease_buf() can copy 16 bytes beyond a short RqLs record into fid-\u003elease_key; cifs_do_create() can retain it through smb2_set_lease_key(), and a later add_lease_context() returns those adjacent kernel bytes to the server, repeatably exposing heap memory.\nI:N - The vulnerable lease and QFid handlers only read into designated scalar, lease-key, and IndexNumber outputs; they neither overwrite out-of-bounds kernel memory nor provide a write or control-flow primitive.\nA:H - A final RqLs record can contain only its 20-byte header and name while smb3_parse_lease_buf() reads through Epoch at canonical offset 72; placing that record at the response-buffer tail makes the fixed-width loads cross the allocation and can produce a repeatable kernel fault or oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:08:54.144Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e4c49012708c917eafd9c27054b02d0f8b30fe64"
        },
        {
          "url": "https://git.kernel.org/stable/c/28bc9a871799363afa3139e961a8e3684feb8704"
        },
        {
          "url": "https://git.kernel.org/stable/c/05a7fd80024ff32b9b40ab1478bb172eeab1c386"
        },
        {
          "url": "https://git.kernel.org/stable/c/cecc5399987e73a528ce2b662eeb54af69163cbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/67f4c1c6a1b51e203d986779299824d1c2c590a6"
        }
      ],
      "title": "smb: client: fix create context out-of-bounds reads",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98454",
    "datePublished": "2026-10-18T15:15:04.139Z",
    "dateReserved": "2026-09-25T10:25:14.350Z",
    "dateUpdated": "2026-10-24T14:08:54.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.