{"schema":"threatline.record/2","record":{"id":"CVE-2026-98169","aliases":[],"summary":"smb: client: fix potential OOB read in smb3_enum_snapshots()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential OOB read in smb3_enum_snapshots()\n\nIf snapshot_array_size is smaller than GMT_TOKEN_SIZE,\nsmb3_enum_snapshots() sets ret_data_len to\nsizeof(struct smb_snapshot_array) without verifying the actual length\nof the server's reply.\n\nBecause SMB2_ioctl() places no lower bound on the server-supplied\nOutputCount and allocates retbuf to exactly that length, a short reply\nresults in ret_data_len exceeding the size of retbuf. The subsequent\ncopy_to_user() then reads past the end of retbuf, leaking adjacent slab\nmemory to userspace.  The subsequent clamp check is ineffective as it\nonly reduces ret_data_len.\n\nFix this by rejecting replies shorter than\nsizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set\nto the 12-byte struct size rather than the 16-byte\nMIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes\nis exactly what copy_to_user() attempts to read.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"15a221c734b9d044ab769e7e3606b2cab96fb65a","status":"affected","versionType":"git"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"74995ee8305a7c4d76ee70d6acd996a75eda3c03","status":"affected","versionType":"git"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"210f0f1f67817e7d2348b86b5115a9b85ef5c98b","status":"affected","versionType":"git"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"1cdf0d304d820fb13bf0faf532c3459600f9ea43","status":"affected","versionType":"git"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"dbe452a905dfe2804647530a9ff3d7e3826ed04d","status":"affected","versionType":"git"},{"version":"e02789a53d71334b067ad72eee5d4e88a0158083","lessThan":"4775c3b7a597907e0b97556c7986fda238a377ae","status":"affected","versionType":"git"},{"version":"a94703ff8e3647f8a9a3a92a468450299a7b77e9","status":"affected","versionType":"git"},{"version":"82a856f527334ffd69aae26e7dd9e03b19c4a520","status":"affected","versionType":"git"},{"version":"25b981bfe192fd208ba04c81f4aa30ffb5141660","status":"affected","versionType":"git"},{"version":"4.9.125","lessThan":"4.10","status":"affected","versionType":"semver"},{"version":"4.14.68","lessThan":"4.15","status":"affected","versionType":"semver"},{"version":"4.18.6","lessThan":"4.19","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"15a221c734b9d044ab769e7e3606b2cab96fb65a","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"74995ee8305a7c4d76ee70d6acd996a75eda3c03","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"210f0f1f67817e7d2348b86b5115a9b85ef5c98b","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"1cdf0d304d820fb13bf0faf532c3459600f9ea43","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"4775c3b7a597907e0b97556c7986fda238a377ae","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"4.10","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"4.15","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","source_modified_at":"2026-10-19T09:15:00.713Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"4.19","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00432,"percentile":0.36527,"score_date":"2026-10-23"},"published_at":"2026-10-06T08:44:14.339Z","modified_at":"2026-10-19T09:15:00.713Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98169","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:15:00.713Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98169","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/15a221c734b9d044ab769e7e3606b2cab96fb65a"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/74995ee8305a7c4d76ee70d6acd996a75eda3c03"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/210f0f1f67817e7d2348b86b5115a9b85ef5c98b"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/1cdf0d304d820fb13bf0faf532c3459600f9ea43"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/dbe452a905dfe2804647530a9ff3d7e3826ed04d"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/4775c3b7a597907e0b97556c7986fda238a377ae"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:15:00.713Z","content_hash":"81f91c2833378ce12a0370be95e90886f08b591d8bece104d8e44486191b2bc7"}}