CVE-2026-97565: smb: client: reject short READ responses in CIFSSMBRead()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject short READ responses in CIFSSMBRead()
CIFSSMBRead() reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The length of the response is recorded in rspiov.iovlen, but nothing constrains it to be at least readrspsize before those fields are dereferenced.
A malicious or compromised SMB1 server can return a response shorter than the READRSP header, so that parsing the header itself reads past the end of the receive buffer. SMB1 is not negotiated by default; reaching this code requires an explicit vers=1.0 mount.
Reject the response unless it is at least readrspsize bytes long.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems are exposed only when the Linux kernel SMB client mounts an SMB1 share using an explicit vers=1.0 option. SMB1 is not negotiated by default.
What must an attacker control to trigger the flaw?
An attacker would need to operate or compromise an SMB1 server that the affected client mounts. The server can then send a READ response shorter than the expected READ_RSP header.
How can I determine whether my environment may be affected?
Review SMB client mount configuration and active mounts for explicit vers=1.0 usage. Mounts using other SMB protocol versions do not reach the described code path.
What can be done if the kernel update cannot be applied immediately?
Avoid SMB1 mounts by removing explicit vers=1.0 options and using another supported SMB protocol version where possible. Do not mount untrusted or potentially compromised SMB1 servers.