UBUNTU-CVE-2026-98170: Medium severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs() In movesmb2eatocifs(), the while (srcsize > 0) loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete smb2eainfo structure. Consequently, reads of eanamelength and eavaluelength can occur out-of-bounds. Fix this by ensuring srcsize >= sizeof(src) before attempting to read any structure fields. Additionally, reject any nextentryoffset that is smaller than sizeof(src) or that would advance the pointer beyond the available buffer. Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating "attribute not present" or "output buffer too small".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In Linux kernel smb client function move_smb2_ea_to_cifs(), ensure src_size >= sizeof(*src) before reading structure fields, and reject any next_entry_offset smaller than sizeof(*src) or that would advance the pointer beyond the available buffer.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using one of the listed Ubuntu Linux kernel packages are potentially exposed when they use the SMB client to process extended-attribute (EA) lists returned by an SMB server. The affected package list includes linux, linux-azure, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-gcp, and linux-oracle.
What does an attacker need to exploit it?
An attacker needs to cause the SMB client to process a malformed EA list from a server. The vector is network-based, requires no privileges, but requires user interaction according to the supplied metrics.
How can I recognize the corrected behavior after applying the fix?
For malformed EA lists returned by a server, getxattr or listxattr now returns -EIO. Previously, the same condition could return -ENODATA for getxattr or -ERANGE for listxattr.