CVE-2026-98405

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98405", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.347Z", "datePublished": "2026-10-14T13:27:40.589Z", "dateUpdated": "2026-10-24T14:08:44.159Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:08:44.159Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix missing iov bounds check in parse_posix_sids()\n\nIn parse_posix_sids(), sidsbuf_end is calculated using the server-supplied\nout_len without being validated against the actual length of the received\niov (iov_len).\n\nIf a server provides an inflated out_len, sidsbuf_end will point past the\nend of the iov. This defeats the bounds guards in posix_info_sid_size(),\nallowing out-of-bounds reads into adjacent kernel memory.\n\nFix this by rejecting responses where the calculated sidsbuf_end would\nexceed the received iov boundaries or cause pointer wraparound."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - A malicious SMB server supplies the malformed OutputBufferLength and SID payload in an SMB2 QUERY_INFO response over TCP; cifs_root_iget() or cifs_getattr() reaches smb2_query_path_info(), smb2_compound_op(), then parse_posix_sids().\nAC:L - The server can place a valid SID header at the iov boundary and set num_subauth so parse_posix_sids() copies up to 68 bytes beyond it. Once the POSIX mount exists, triggering is deterministic and requires no race or uncontrollable heap state.\nPR:N - Session setup and tree connect precede compound_send_recv(), but the attacker is the SMB server endpoint and needs no account or capability on the client to choose the QUERY_INFO response.\nUI:R - The victim must mount the attacker-controlled share with the posix option, which sets ctx->linux_ext; cifs_read_super() then calls cifs_root_iget(), which immediately issues the vulnerable POSIX metadata query.\nS:U - The out-of-bounds access occurs in the SMB client and affects the same host kernel executing parse_posix_sids(); it crosses no VM, IOMMU, or sandbox security boundary.\nC:H - An inflated end pointer defeats posix_info_sid_size() bounds checks, allowing each owner or group SID memcpy() to consume up to 68 bytes of adjacent kernel memory and pass those bytes into SID/idmap processing.\nI:N - posix_info_sid_size() caps num_subauth at 15, so each memcpy() remains within its destination struct smb_sid; the defect performs out-of-bounds reads but provides no out-of-bounds write or control-flow modification.\nA:H - By ending the received iov at a SID header while claiming a larger OutputBufferLength, the server makes posix_info_sid_size() and memcpy() access beyond the receive allocation, which can fault and oops or panic the client kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2inode.c"], "versions": [{"version": "a90f37e3d7acfd9824f162830583bbf7846fe252", "lessThan": "d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644", "status": "affected", "versionType": "git"}, {"version": "858e74876c5cbff1dfd5bace99e32fbce2abd4b5", "lessThan": "b862996e5105be1293da9cdc85da77b76021c3bd", "status": "affected", "versionType": "git"}, {"version": "858e74876c5cbff1dfd5bace99e32fbce2abd4b5", "lessThan": "2f8ed71aaaba3bc8b19cd9930cc62e63e142b299", "status": "affected", "versionType": "git"}, {"version": "858e74876c5cbff1dfd5bace99e32fbce2abd4b5", "lessThan": "eac6917a42899aad0617bbf04798c5dd946a1fe5", "status": "affected", "versionType": "git"}, {"version": "858e74876c5cbff1dfd5bace99e32fbce2abd4b5", "lessThan": "b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc", "status": "affected", "versionType": "git"}, {"version": "6.6.32", "lessThan": "6.6.158", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2inode.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.32", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644"}, {"url": "https://git.kernel.org/stable/c/b862996e5105be1293da9cdc85da77b76021c3bd"}, {"url": "https://git.kernel.org/stable/c/2f8ed71aaaba3bc8b19cd9930cc62e63e142b299"}, {"url": "https://git.kernel.org/stable/c/eac6917a42899aad0617bbf04798c5dd946a1fe5"}, {"url": "https://git.kernel.org/stable/c/b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc"}], "title": "smb: client: fix missing iov bounds check in parse_posix_sids()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644", "status": "affected", "version": "a90f37e3d7acfd9824f162830583bbf7846fe252", "versionType": "git"}, {"lessThan": "b862996e5105be1293da9cdc85da77b76021c3bd", "status": "affected", "version": "858e74876c5cbff1dfd5bace99e32fbce2abd4b5", "versionType": "git"}, {"lessThan": "2f8ed71aaaba3bc8b19cd9930cc62e63e142b299", "status": "affected", "version": "858e74876c5cbff1dfd5bace99e32fbce2abd4b5", "versionType": "git"}, {"lessThan": "eac6917a42899aad0617bbf04798c5dd946a1fe5", "status": "affected", "version": "858e74876c5cbff1dfd5bace99e32fbce2abd4b5", "versionType": "git"}, {"lessThan": "b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc", "status": "affected", "version": "858e74876c5cbff1dfd5bace99e32fbce2abd4b5", "versionType": "git"}, {"lessThan": "6.6.158", "status": "affected", "version": "6.6.32", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix missing iov bounds check in parse_posix_sids()\n\nIn parse_posix_sids(), sidsbuf_end is calculated using the server-supplied\nout_len without being validated against the actual length of the received\niov (iov_len).\n\nIf a server provides an inflated out_len, sidsbuf_end will point past the\nend of the iov. This defeats the bounds guards in posix_info_sid_size(),\nallowing out-of-bounds reads into adjacent kernel memory.\n\nFix this by rejecting responses where the calculated sidsbuf_end would\nexceed the received iov boundaries or cause pointer wraparound."}], "id": "CVE-2026-98405", "lastModified": "2026-10-24T14:16:40.877", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-14T14:17:51.603", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2f8ed71aaaba3bc8b19cd9930cc62e63e142b299"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b862996e5105be1293da9cdc85da77b76021c3bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eac6917a42899aad0617bbf04798c5dd946a1fe5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: smb: client: fix missing iov bounds check in parse_posix_sids()", "id": "2552207", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552207"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: fix missing iov bounds check in parse_posix_sids()\nIn parse_posix_sids(), sidsbuf_end is calculated using the server-supplied\nout_len without being validated against the actual length of the received\niov (iov_len).\nIf a server provides an inflated out_len, sidsbuf_end will point past the\nend of the iov. This defeats the bounds guards in posix_info_sid_size(),\nallowing out-of-bounds reads into adjacent kernel memory.\nFix this by rejecting responses where the calculated sidsbuf_end would\nexceed the received iov boundaries or cause pointer wraparound.", "A flaw was found in the Linux kernel's SMB (Server Message Block) client. When parsing POSIX security identifiers in server responses, the client fails to properly validate the server-supplied buffer length against the actual received message boundaries. A malicious or compromised SMB server could exploit this flaw by returning an inflated length value, triggering an out-of-bounds read into adjacent kernel memory. This issue may lead to information disclosure or a denial of service (DoS) caused by a system crash."], "name": "CVE-2026-98405", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98405\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98405\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98405.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a90f37e3d7acfd9824f162830583bbf7846fe252,d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[858e74876c5cbff1dfd5bace99e32fbce2abd4b5,b862996e5105be1293da9cdc85da77b76021c3bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[858e74876c5cbff1dfd5bace99e32fbce2abd4b5,2f8ed71aaaba3bc8b19cd9930cc62e63e142b299)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[858e74876c5cbff1dfd5bace99e32fbce2abd4b5,eac6917a42899aad0617bbf04798c5dd946a1fe5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[858e74876c5cbff1dfd5bace99e32fbce2abd4b5,b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.32,6.6.158)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-15T05:15:14.984289+00:00", "updated": "2026-10-24T15:30:14.544955+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}