CVE-2026-43185: ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix signededness bug in smbdirectpreparenegotiation()
smbdirectpreparenegotiation() casts an unsigned u32 value from sp->maxrecvsize and req->preferredsendsize to a signed int before computing mint(int, ...). A maliciously provided preferredsendsize of 0x80000000 will return as smaller than maxrecvsize, and then be used to set the maximum allowed alowed receive size for the next message.
By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow.
This fix replaces mint(int, ...) with mint(u32)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43185?
CVE-2026-43185 has been classified with a medium severity level due to its potential to cause issues in the smb_direct_prepare_negotiation function.
How do I fix CVE-2026-43185?
To fix CVE-2026-43185, update your Linux kernel to the latest stable version which contains the patched code.
What systems are affected by CVE-2026-43185?
CVE-2026-43185 affects systems running the Linux kernel with ksmbd, particularly those using SMB direct.
What kind of vulnerability is CVE-2026-43185?
CVE-2026-43185 is a signedness bug that impacts the proper functioning of the smb_direct_prepare_negotiation function.
What is the impact of CVE-2026-43185 on system security?
The impact of CVE-2026-43185 can lead to unexpected behaviors in file sharing over SMB if exploited.