« Volver al listado

CVE-2026-98170

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds.

Fix this by ensuring src_size >= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer.

Leer descripción completaMostrar menos

Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating "attribute not present" or "output buffer too small".

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98170",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "95907fea4fd8ccc736e0a428e52159b4d42b9958",
              "lessThan": "d3546cecbf81d98bf3b472d341f981eb48c04f47",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "95907fea4fd8ccc736e0a428e52159b4d42b9958",
              "lessThan": "34a3942e787b9c59758115bd65fe1ec89d68c7a4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "95907fea4fd8ccc736e0a428e52159b4d42b9958",
              "lessThan": "13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "95907fea4fd8ccc736e0a428e52159b4d42b9958",
              "lessThan": "eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/smb/client/smb2ops.c",
            "fs/smb/client/trace.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/smb/client/smb2ops.c",
            "fs/smb/client/trace.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:17:58.640",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/34a3942e787b9c59758115bd65fe1ec89d68c7a4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d3546cecbf81d98bf3b472d341f981eb48c04f47",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()\n\nIn move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is\ninsufficient. It allows iteration to continue even if the remaining\nsrc_size is too small to contain a complete smb2_ea_info structure.\nConsequently, reads of ea_name_length and ea_value_length can occur\nout-of-bounds.\n\nFix this by ensuring src_size >= sizeof(*src) before attempting to read\nany structure fields. Additionally, reject any next_entry_offset that is\nsmaller than sizeof(*src) or that would advance the pointer beyond the\navailable buffer.\n\nNote that for calls where the server returns a malformed EA list, the\nerror returned to userspace changes from -ENODATA (getxattr) or\n-ERANGE (listxattr) to -EIO. This correctly signals a server protocol\nerror rather than misleadingly indicating \"attribute not present\" or\n\"output buffer too small\"."
    }
  ],
  "lastModified": "2026-10-06T09:17:58.640",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}