CVE-2026-98405
Description
A flaw was found in the Linux kernel's SMB (Server Message Block) client. When parsing POSIX security identifiers in server responses, the client fails to properly validate the server-supplied buffer length against the actual received message boundaries. A malicious or compromised SMB server could exploit this flaw by returning an inflated length value, triggering an out-of-bounds read into adjacent kernel memory. This issue may lead to information disclosure or a denial of service (DoS) caused by a system crash.
Statement
The SMB client parse_posix_sids path calculates sidsbuf_end from the server supplied out_len without first validating it against the actual received iov length. A malicious or compromised SMB server can provide an inflated length and make posix_info_sid_size read beyond the response buffer into adjacent kernel memory. This may cause a kernel crash or invalid SID parsing and therefore represents a remotely triggerable availability risk for clients connected to an attacker controlled server. For the CVSS the PR:N value is used because the attacker does not need credentials or local privileges on the affected client and only needs control of the SMB server response. AV:N is used because the malformed response can be delivered over a routed SMB connection. The base impact is denial of service because no direct return path for the out of bounds kernel data is demonstrated. The issue does not justify CIA:HHH because the available primitive is an out of bounds read rather than an arbitrary write or a demonstrated use after free.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
