CVE-2026-98169: smb: client: fix potential OOB read in smb3_enum_snapshots()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential OOB read in smb3enumsnapshots()
If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots() sets retdatalen to sizeof(struct smbsnapshotarray) without verifying the actual length of the server's reply.
Because SMB2ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in retdatalen exceeding the size of retbuf. The subsequent copytouser() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces retdatalen.
Fix this by rejecting replies shorter than sizeof(struct smbsnapshotarray) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MINSNAPSHOTARRAYSIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copytouser() attempts to read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In smb3_enum_snapshots(), reject server replies shorter than sizeof(struct smb_snapshot_array) with -EIO before copying data to userspace.
Event History
Frequently Asked Questions
What attacker-controlled condition is required to trigger the out-of-bounds read?
An SMB server must return a snapshot enumeration IOCTL reply whose OutputCount is shorter than sizeof(struct smb_snapshot_array). The vulnerable client then can copy more data to userspace than was allocated for the server reply.
Who is exposed to this issue?
Linux systems acting as SMB clients are exposed when they enumerate SMB3 snapshots against a server that supplies a malformed short response. The issue leaks adjacent kernel slab memory to local userspace through the client operation.
What does the fix do?
The fix rejects snapshot enumeration replies shorter than sizeof(struct smb_snapshot_array) with -EIO. This prevents copy_to_user() from reading beyond the allocated response buffer.