UBUNTU-CVE-2026-98171: Integer Overflow
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard()'s handling of compound encrypted frames: - Clear nextbuffer after assigning it to server->bigbuf. A stale nextbuffer pointer can lead to a use-after-free on subsequent error paths. - Update pdulength to the decrypted plaintext size (bufsize). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject nextcmd values smaller than MIDHEADERSIZE(server). - Fix an integer overflow in the upper bound check by verifying pdulength - nextcmd < MIDHEADERSIZE(server), ensuring the trailing slice is large enough for a header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In receive_encrypted_standard(), validate compound encrypted frames by rejecting next_cmd values smaller than MID_HEADER_SIZE(server), checking whether pdu_length - next_cmd < MID_HEADER_SIZE(server) before accepting the trailing slice, and setting pdu_length to the decrypted plaintext size (buf_size). Clear next_buffer immediately after assigning it to server->bigbuf to prevent use-after-free on subsequent error paths.
Event History
Frequently Asked Questions
Which systems are in scope for this issue?
The affected software list includes Ubuntu linux, linux-azure, linux-gcp, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, and linux-realtime. The vulnerable code path is in the SMB client’s handling of encrypted compound frames.
What packet conditions trigger the vulnerable handling?
The issue involves compound encrypted SMB PDUs whose NextCommand value is processed after decryption. Problematic values include offsets smaller than the server MID header size or offsets that leave insufficient space for a trailing header; stale pointer handling on error paths can also lead to use-after-free.