CVE-2026-98405: smb: client: fix missing iov bounds check in parse_posix_sids()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missing iov bounds check in parseposixsids()
In parseposixsids(), sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov (iovlen).
If a server provides an inflated outlen, sidsbufend will point past the end of the iov. This defeats the bounds guards in posixinfosidsize(), allowing out-of-bounds reads into adjacent kernel memory.
Fix this by rejecting responses where the calculated sidsbufend would exceed the received iov boundaries or cause pointer wraparound.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In parse_posix_sids(), validate the server-supplied out_len against the actual received iov_len and reject responses when the calculated sidsbuf_end exceeds the received iov boundaries or causes pointer wraparound.
Event History
Frequently Asked Questions
What does an attacker need to control to trigger this issue?
An attacker would need to control, compromise, or impersonate an SMB server that can send a response with an inflated out_len value to the Linux SMB client.
Which deployments are relevant when triaging exposure?
The issue applies to Linux kernel SMB client use where POSIX SID information is parsed from a server response. Systems not acting as SMB clients for such responses are not implicated by the provided information.
What is the effect of a malicious response?
An inflated server-supplied length can make the client’s calculated SID buffer endpoint extend beyond the received I/O vector, bypassing intended bounds checks and causing out-of-bounds reads into adjacent kernel memory.