All vulnerabilities
CVE-2026-98405

Linux: smb: client: fix missing iov bounds check in parse_posix_sids()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2f8ed71aaaba3bc8b19cd9930cc62e63e142b299Also 6.6.158CVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix missing iov bounds check in parse_posix_sids()

In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len).

If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory.

Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.

Text from CVE List

Affected versions 13

  • Linuxaffected: a90f37e3d7acfd9824f162830583bbf7846fe252 before d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644CVE List
  • Linuxaffected: 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 before b862996e5105be1293da9cdc85da77b76021c3bdCVE List
  • Linuxaffected: 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 before 2f8ed71aaaba3bc8b19cd9930cc62e63e142b299CVE List
  • Linuxaffected: 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 before eac6917a42899aad0617bbf04798c5dd946a1fe5CVE List
  • Linuxaffected: 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 before b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dcCVE List
  • Linuxaffected: 6.6.32 before 6.6.158CVE List
  • Linuxaffected: 6.8CVE List
  • Linuxunaffected: all versions before 6.8CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5