CVE-2026-98167: smb: client: fix server->total_read for compound encrypted PDUs
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix server->totalread for compound encrypted PDUs
In receiveencryptedstandard(), server->totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result, cifshandlestandard() passes this full size to smb2checkmessage(), causing the PDU length guards to incorrectly validate the entire compound frame instead of the current sub-PDU.
This allows truncated non-last sub-PDUs to bypass length validation, leading to out-of-bounds reads in smb2getdataarealen().
Fix this by setting server->totalread to the true length of the current sub-PDU: nextcmd for non-last sub-PDUs, and the remaining pdulength for the last one.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.189 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Set server->total_read to the true length of the current sub-PDU while processing compound encrypted PDUs: use next_cmd for non-last sub-PDUs and the remaining pdu_length for the last one.
Linux kernel SMB client server->total_read = next_cmd for non-last sub-PDUs; remaining pdu_length for the last sub-PDU
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux systems using the SMB client are exposed when they process compound encrypted SMB PDUs from a server. The affected code is in the client-side receive path.
What must an attacker provide to trigger the vulnerable path?
The client must receive a compound encrypted frame containing a truncated non-last sub-PDU. The incorrect length validation can then allow an out-of-bounds read in smb2_get_data_area_len().