UBUNTU-CVE-2026-98169: Low severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3enumsnapshots() If snapshotarraysize is smaller than GMTTOKENSIZE, smb3enumsnapshots() sets retdatalen to sizeof(struct smbsnapshotarray) without verifying the actual length of the server's reply. Because SMB2ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in retdatalen exceeding the size of retbuf. The subsequent copytouser() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces retdatalen. Fix this by rejecting replies shorter than sizeof(struct smbsnapshotarray) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MINSNAPSHOTARRAYSIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copytouser() attempts to read.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In SMB2_ioctl()/smb3_enum_snapshots(), reject server replies shorter than sizeof(struct smb_snapshot_array) with -EIO before setting ret_data_len or copying data.