All vulnerabilities
CVE-2026-98171

Linux: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.51%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in72eaef1f37a3b6bec11c342736834dc3707be3e4Also 491e33144dee872cffda207f6fcb09260728f803, 8749946579708ea0d339034bb7f423a67dbe89cf and 3 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 72eaef1f37a3b6bec11c342736834dc3707be3e4LinuxCVE List
  • 491e33144dee872cffda207f6fcb09260728f803LinuxCVE List
  • 8749946579708ea0d339034bb7f423a67dbe89cfLinuxCVE List
  • 96c436e4b010711452b2872558938f4ef276492aLinuxCVE List
  • 858d5ac22cb889266993e7670f9f0c4f4aeedd78LinuxCVE List
  • 05762c5bc1cfdcac36747994fde2c04387a457f1LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames:

  • Clear next_buffer after assigning it to server->bigbuf. A stale

next_buffer pointer can lead to a use-after-free on subsequent error paths.

  • Update pdu_length to the decrypted plaintext size (buf_size). Using

the pre-decryption length allows NextCommand to point into stale ciphertext residue.

  • Reject next_cmd values smaller than MID_HEADER_SIZE(server).
  • Fix an integer overflow in the upper bound check by verifying

pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.

Text from CVE List

Affected versions 14

  • Linuxaffected: b24df3e30cbf48255db866720fb71f14bf9d2f39 before 72eaef1f37a3b6bec11c342736834dc3707be3e4CVE List
  • Linuxaffected: b24df3e30cbf48255db866720fb71f14bf9d2f39 before 491e33144dee872cffda207f6fcb09260728f803CVE List
  • Linuxaffected: b24df3e30cbf48255db866720fb71f14bf9d2f39 before 8749946579708ea0d339034bb7f423a67dbe89cfCVE List
  • Linuxaffected: b24df3e30cbf48255db866720fb71f14bf9d2f39 before 96c436e4b010711452b2872558938f4ef276492aCVE List
  • Linuxaffected: b24df3e30cbf48255db866720fb71f14bf9d2f39 before 858d5ac22cb889266993e7670f9f0c4f4aeedd78CVE List
  • Linuxaffected: b24df3e30cbf48255db866720fb71f14bf9d2f39 before 05762c5bc1cfdcac36747994fde2c04387a457f1CVE List
  • Linuxaffected: 4.19CVE List
  • Linuxunaffected: all versions before 4.19CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6