CVE-2026-43185

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43185", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.991Z", "datePublished": "2026-05-06T11:27:56.386Z", "dateUpdated": "2026-10-30T12:25:08.090Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:25:08.090Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix signededness bug in smb_direct_prepare_negotiation()\n\nsmb_direct_prepare_negotiation() casts an unsigned __u32 value\nfrom sp->max_recv_size and req->preferred_send_size to a signed\nint before computing min_t(int, ...). A maliciously provided\npreferred_send_size of 0x80000000 will return as smaller than\nmax_recv_size, and then be used to set the maximum allowed\nalowed receive size for the next message.\n\nBy sending a second message with a large value (>1420 bytes)\nthe attacker can then achieve a heap buffer overflow.\n\nThis fix replaces min_t(int, ...) with min_t(u32)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable ksmbd SMB Direct negotiation is reached by a remote peer over the network via the RDMA listener on SMB Direct ports such as 445/5445.\nAC:L - An attacker can trigger the bug with a crafted negotiation request followed by an oversized data-transfer message; no race or victim-controlled timing is required.\nPR:N - The vulnerable path runs during SMB Direct transport negotiation before SMB authentication or session setup, so no credentials or prior privileges are required.\nUI:N - No victim user action is needed beyond the server exposing ksmbd SMB Direct; the attacker sends network protocol messages directly.\nS:U - The impact is kernel memory corruption within the same host security authority, not a cross-scope escape such as guest-to-host or IOMMU boundary bypass.\nC:H - The signedness bug lets the attacker turn a small allocated receive buffer into a huge posted RDMA receive target, causing attacker-controlled kernel heap memory corruption that can plausibly be leveraged for information disclosure.\nI:H - The second SMB Direct message causes an out-of-bounds write/DMA overwrite into kernel heap memory, which is high-integrity impact and plausibly exploitable for control-flow or data corruption.\nA:H - The heap buffer overflow is remotely triggerable pre-authentication and can crash or panic the kernel even without full code execution."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/transport_rdma.c"], "versions": [{"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "56eab82fa6fb5ca024b0514e249d40d9b23ee5a7", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "a110dbe928561d440e9e117d17331139a0bedace", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "ceae058eb707ddd0d68f0872f9d9f23b7c30c37b", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "55abc475d096da4a5356b6efb0cfdc6156bc1550", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "6b4f875aac344cdd52a1f34cc70ed2f874a65757", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/transport_rdma.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c"}, {"url": "https://git.kernel.org/stable/c/56eab82fa6fb5ca024b0514e249d40d9b23ee5a7"}, {"url": "https://git.kernel.org/stable/c/a110dbe928561d440e9e117d17331139a0bedace"}, {"url": "https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b"}, {"url": "https://git.kernel.org/stable/c/55abc475d096da4a5356b6efb0cfdc6156bc1550"}, {"url": "https://git.kernel.org/stable/c/6b4f875aac344cdd52a1f34cc70ed2f874a65757"}], "title": "ksmbd: fix signededness bug in smb_direct_prepare_negotiation()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/transport_rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}, {"lessThan": "56eab82fa6fb5ca024b0514e249d40d9b23ee5a7", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}, {"lessThan": "a110dbe928561d440e9e117d17331139a0bedace", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}, {"lessThan": "ceae058eb707ddd0d68f0872f9d9f23b7c30c37b", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}, {"lessThan": "55abc475d096da4a5356b6efb0cfdc6156bc1550", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}, {"lessThan": "6b4f875aac344cdd52a1f34cc70ed2f874a65757", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/transport_rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E3B207F9-B76D-4B19-8860-9E40E6B32274", "versionEndExcluding": "6.18.16", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix signededness bug in smb_direct_prepare_negotiation()\n\nsmb_direct_prepare_negotiation() casts an unsigned __u32 value\nfrom sp->max_recv_size and req->preferred_send_size to a signed\nint before computing min_t(int, ...). A maliciously provided\npreferred_send_size of 0x80000000 will return as smaller than\nmax_recv_size, and then be used to set the maximum allowed\nalowed receive size for the next message.\n\nBy sending a second message with a large value (>1420 bytes)\nthe attacker can then achieve a heap buffer overflow.\n\nThis fix replaces min_t(int, ...) with min_t(u32)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: ksmbd: corrige un error de signo en smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() convierte un valor __u32 sin signo de sp -> max_recv_size y req -> preferred_send_size a un entero con signo antes de calcular min_t(int, ...). Un preferred_send_size proporcionado maliciosamente de 0x 80000000 resultar\u00e1 ser menor que max_recv_size, y luego se utilizar\u00e1 para establecer el tama\u00f1o m\u00e1ximo de recepci\u00f3n permitido para el siguiente mensaje. Al enviar un segundo mensaje con un valor grande (mayor que 1420 bytes), el atacante puede entonces lograr un desbordamiento de b\u00fafer de pila. Esta correcci\u00f3n reemplaza min_t(int, ...) con min_t(u32)"}], "id": "CVE-2026-43185", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-06T12:16:37.187", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/55abc475d096da4a5356b6efb0cfdc6156bc1550"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/56eab82fa6fb5ca024b0514e249d40d9b23ee5a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6b4f875aac344cdd52a1f34cc70ed2f874a65757"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a110dbe928561d440e9e117d17331139a0bedace"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: fix signededness bug in smb_direct_prepare_negotiation()", "id": "2467196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467196"}, "csaw": false, "cwe": "CWE-681", "details": ["A flaw was found in ksmbd within the Linux kernel. A remote attacker can exploit a signedness bug in the smb_direct_prepare_negotiation() function by sending a specially crafted preferred_send_size value during SMB direct negotiation. This manipulation leads to an incorrect size calculation, allowing a subsequent large message to trigger a heap buffer overflow. A successful exploit could result in arbitrary code execution or a denial of service."], "name": "CVE-2026-43185", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43185\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43185\nhttps://lore.kernel.org/linux-cve-announce/2026050640-CVE-2026-43185-55a5@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0626e6641f6b467447c81dd7678a69c66f7746cf,ceae058eb707ddd0d68f0872f9d9f23b7c30c37b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0626e6641f6b467447c81dd7678a69c66f7746cf,55abc475d096da4a5356b6efb0cfdc6156bc1550)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0626e6641f6b467447c81dd7678a69c66f7746cf,6b4f875aac344cdd52a1f34cc70ed2f874a65757)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T16:30:06.712019+00:00", "updated": "2026-05-11T23:15:09.788635+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}