UBUNTU-CVE-2026-43185: Buffer Overflow

Q: Which systems are exposed to this issue?

Systems running the affected Ubuntu Linux kernel packages are exposed if they have the ksmbd SMB server functionality available to process SMB Direct negotiation requests. The listed package families include linux, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-riscv, linux-gke, and linux-gkeop.

Q: What does an attacker need to send to trigger the overflow?

An unauthenticated network attacker can provide a preferred_send_size value of 0x80000000 during SMB Direct negotiation, causing an incorrect maximum receive size to be set. The attacker can then send a second message larger than 1420 bytes to trigger the heap buffer overflow.

Q: Is user interaction or prior authentication required?

No. The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

Published May 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smbdirectpreparenegotiation() smbdirectpreparenegotiation() casts an unsigned u32 value from sp->maxrecvsize and req->preferredsendsize to a signed int before computing mint(int, ...). A maliciously provided preferredsendsize of 0x80000000 will return as smaller than maxrecvsize, and then be used to set the maximum allowed alowed receive size for the next message. By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow. This fix replaces mint(int, ...) with mint(u32)

Affected Software

190 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1111.118~20.04.1

5.15.0-1111.118~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1116.125~20.04.1

5.15.0-1116.125~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15<5.15.0-1116.125~20.04.1

5.15.0-1116.125~20.04.1

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1111.121~20.04.1

5.15.0-1111.121~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-185.195~20.04.1

5.15.0-185.195~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm-5.15<5.15.0-1105.109~20.04.1

5.15.0-1105.109~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1106.112~20.04.1

5.15.0-1106.112~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-183.193~20.04.1

5.15.0-183.193~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1063.63~20.04.1

5.15.0-1063.63~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1108.114~20.04.1

5.15.0-1108.114~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1105.109~20.04.1

5.15.0-1105.109~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-185.195

5.15.0-185.195

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1111.118

5.15.0-1111.118

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1060.63~22.04.1

6.8.0-1060.63~22.04.1

ubuntu/linux-azure<5.15.0-1116.125

5.15.0-1116.125

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1063.71~22.04.1

6.8.0-1063.71~22.04.1

ubuntu/linux-azure-fde<5.15.0-1116.125

5.15.0-1116.125

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1062.69~22.04.1

6.8.0-1062.69~22.04.1

ubuntu/linux-gcp<5.15.0-1111.121

5.15.0-1111.121

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1063.69~22.04.1

6.8.0-1063.69~22.04.1

ubuntu/linux-gke<5.15.0-1107.113

5.15.0-1107.113

ubuntu/linux-gkeop<5.15.0-1094.102

5.15.0-1094.102

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-136.136~22.04.1

6.8.0-136.136~22.04.1

ubuntu/linux-ibm<5.15.0-1105.109

5.15.0-1105.109

ubuntu/linux-ibm-6.8<6.8.0-1060.61~22.04.1

6.8.0-1060.61~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1106.112

5.15.0-1106.112

ubuntu/linux-kvm<5.15.0-1103.108

5.15.0-1103.108

ubuntu/linux-lowlatency<5.15.0-183.193

5.15.0-183.193

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-134.134.1~22.04.1

6.8.0-134.134.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1106.107

5.15.0-1106.107

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1058.61~22.04.1

6.8.0-1058.61~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1063.63

5.15.0-1063.63

ubuntu/linux-nvidia-tegra-igx<5.15.0-1052.52

5.15.0-1052.52

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1108.114

5.15.0-1108.114

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1057.58~22.04.1

6.8.0-1057.58~22.04.1

ubuntu/linux-raspi<5.15.0-1105.108

5.15.0-1105.108

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-134.134~22.04.1

6.8.0-134.134~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1074.78

5.15.0-1074.78

ubuntu/linux-bluefield<5.15.0-1095.97

5.15.0-1095.97

ubuntu/linux-intel-iot-realtime<5.15.0-1103.105

5.15.0-1103.105

ubuntu/linux-realtime<5.15.0-1110.119

5.15.0-1110.119

ubuntu/linux-realtime-6.8<6.8.1-1055.56~22.04.1

6.8.1-1055.56~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1111.118+fips1

5.15.0-1111.118+fips1

ubuntu/linux-azure-fips<5.15.0-1116.125+fips1

5.15.0-1116.125+fips1

ubuntu/linux-fips<5.15.0-185.195+fips1

5.15.0-185.195+fips1

ubuntu/linux-gcp-fips<5.15.0-1111.121+fips1

5.15.0-1111.121+fips1

ubuntu/linux<6.8.0-134.134

6.8.0-134.134

ubuntu/linux-aws<6.8.0-1060.63

6.8.0-1060.63

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-azure<6.8.0-1063.71

6.8.0-1063.71

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17<6.17.0-1021.21~24.04.1

6.17.0-1021.21~24.04.1

ubuntu/linux-azure-fde<6.8.0-1062.69

6.8.0-1062.69

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1063.69

6.8.0-1063.69

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-6.17<6.17.0-1020.22~24.04.1

6.17.0-1020.22~24.04.1

ubuntu/linux-gke<6.8.0-1058.64

6.8.0-1058.64

ubuntu/linux-gkeop<6.8.0-1045.48

6.8.0-1045.48

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17<6.17.0-40.40~24.04.1

6.17.0-40.40~24.04.1

ubuntu/linux-ibm<6.8.0-1060.61

6.8.0-1060.61

ubuntu/linux-lowlatency<6.8.0-134.134.1

6.8.0-134.134.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1058.61

6.8.0-1058.61

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1026.26

6.17.0-1026.26

ubuntu/linux-nvidia-lowlatency<6.8.0-1058.61.1

6.8.0-1058.61.1

ubuntu/linux-nvidia-tegra<6.8.0-1029.30

6.8.0-1029.30

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17<6.17.0-1028.28

6.17.0-1028.28

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1057.58

6.8.0-1057.58

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17<6.17.0-1018.18~24.04.1

6.17.0-1018.18~24.04.1

ubuntu/linux-raspi<6.8.0-1060.64

6.8.0-1060.64

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-vmware<6.8.0-1008.8

6.8.0-1008.8

ubuntu/linux-xilinx<6.8.0-1032.33

6.8.0-1032.33

ubuntu/linux-bluefield<6.8.0-1026.30

6.8.0-1026.30

ubuntu/linux-raspi-realtime<6.8.0-2049.50

6.8.0-2049.50

ubuntu/linux-realtime<6.8.1-1055.56

6.8.1-1055.56

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1017.19~24.04.1

6.17.0-1017.19~24.04.1

ubuntu/linux-aws-fips<6.8.0-1060.63+fips1

6.8.0-1060.63+fips1

ubuntu/linux-azure-fips<6.8.0-1062.69+fips1

6.8.0-1062.69+fips1

ubuntu/linux-fips<6.8.0-134.134+fips1

6.8.0-134.134+fips1

ubuntu/linux-gcp-fips<6.8.0-1063.69+fips1

6.8.0-1063.69+fips1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp*

ubuntu/linux-oracle*

ubuntu/linux-raspi<6.17.0-1021.21

6.17.0-1021.21

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.118~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.125~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.125~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.121~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-185.195~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1105.109~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1106.112~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-183.193~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1063.63~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1108.114~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1105.109~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-185.195
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.118
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.125
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.125
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.121
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.69~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1107.113
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1094.102
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1105.109
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.61~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1106.112
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1103.108
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-183.193
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1106.107
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1063.63
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1052.52
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1108.114
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1057.58~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1105.108
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.78
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.97
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1103.105
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1110.119
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1055.56~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.118+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.125+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-185.195+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.121+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71
Upgrade
Upgrade ubuntu/linux-azure-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1021.21~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.69
Upgrade
Upgrade ubuntu/linux-gcp-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1020.22~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.64
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1045.48
Upgrade
Upgrade ubuntu/linux-hwe-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-40.40~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.61
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1026.26
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.30
Upgrade
Upgrade ubuntu/linux-oem-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1028.28
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1057.58
Upgrade
Upgrade ubuntu/linux-oracle-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.18~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.64
Upgrade
Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1032.33
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.30
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2049.50
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1055.56
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1017.19~24.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.69+fips1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.17.0-1021.21

Event History

May 6, 2026

CVE Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running the affected Ubuntu Linux kernel packages are exposed if they have the ksmbd SMB server functionality available to process SMB Direct negotiation requests. The listed package families include linux, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-riscv, linux-gke, and linux-gkeop.

What does an attacker need to send to trigger the overflow?

An unauthenticated network attacker can provide a preferred_send_size value of 0x80000000 during SMB Direct negotiation, causing an incorrect maximum receive size to be set. The attacker can then send a second message larger than 1420 bytes to trigger the heap buffer overflow.

Is user interaction or prior authentication required?

No. The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

UBUNTU-CVE-2026-43185: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to send to trigger the overflow?

Is user interaction or prior authentication required?

Company

Resources

Contact