UBUNTU-CVE-2026-98167: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server->totalread for compound encrypted PDUs In receiveencryptedstandard(), server->totalread is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result, cifshandlestandard() passes this full size to smb2checkmessage(), causing the PDU length guards to incorrectly validate the entire compound frame instead of the current sub-PDU. This allows truncated non-last sub-PDUs to bypass length validation, leading to out-of-bounds reads in smb2getdataarealen(). Fix this by setting server->totalread to the true length of the current sub-PDU: nextcmd for non-last sub-PDUs, and the remaining pdulength for the last one.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Set server->total_read to the true length of the current sub-PDU when processing compound encrypted PDUs: use next_cmd for non-last sub-PDUs and the remaining pdu_length for the last one.
Linux kernel SMB client server->total_read = next_cmd for non-last sub-PDUs; remaining pdu_length for the last sub-PDU
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the affected Ubuntu Linux kernel packages are exposed when they use the SMB client to process encrypted compound SMB PDUs from a server. The listed packages include linux, linux-azure, linux-gcp, linux-aws-fips, linux-fips, linux-realtime, and their listed FIPS variants.
What must an attacker provide to trigger the flaw?
An attacker needs to cause the SMB client to process a compound encrypted SMB frame containing a truncated sub-PDU that is not the last sub-PDU. The malformed sub-PDU can bypass length validation and lead to an out-of-bounds read in smb2_get_data_area_len().
What is the likely impact?
The provided vector indicates availability impact only, with no stated impact to confidentiality or integrity. The out-of-bounds read occurs in the kernel SMB client while parsing the malformed encrypted compound frame.