CVE-2026-98405 - Vulnerability Details

- smb: client: fix missing iov bounds check in parse_posix_sids()

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix missing iov bounds check in parse_posix_sids()

In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied
out_len without being validated against the actual length of the received
iov (iov_len).

If a server provides an inflated out_len, sidsbuf_end will point past the
end of the iov. This defeats the bounds guards in posix_info_sid_size(),
allowing out-of-bounds reads into adjacent kernel memory.

Fix this by rejecting responses where the calculated sidsbuf_end would
exceed the received iov boundaries or cause pointer wraparound.

Published: 2026-10-14

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel SMB client contains an unchecked calculation of an end pointer in parse_posix_sids(). When a server supplies an inflated length value, the calculated end pointer can exceed the actual iov buffer, bypassing bounds checks and enabling an out‑of‑bounds read into adjacent kernel memory. The read is only data extraction, so it can leak sensitive kernel data but does not directly allow code execution or denial of service.

Affected Systems

All Linux kernel versions that include the SMB client code are affected, regardless of vendor or distribution. The flaw lives in the core SMB client implementation shared by all implementations of the kernel.

Risk and Exploitability

The likely attack vector is a malicious SMB server that the client connects to; the attacker must have network access to the SMB client. An EPSS score of < 1% indicates a very low but nonzero probability of exploitation, and the CVSS score of 8.1 reflects high severity. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a90f37e3d7acfd9824f162830583bbf7846fe252`	affected	< d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644
`858e74876c5cbff1dfd5bace99e32fbce2abd4b5`	affected	< b862996e5105be1293da9cdc85da77b76021c3bd
`858e74876c5cbff1dfd5bace99e32fbce2abd4b5`	affected	< 2f8ed71aaaba3bc8b19cd9930cc62e63e142b299
`858e74876c5cbff1dfd5bace99e32fbce2abd4b5`	affected	< eac6917a42899aad0617bbf04798c5dd946a1fe5
`858e74876c5cbff1dfd5bace99e32fbce2abd4b5`	affected	< b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc
`6.6.32`	affected	< 6.6.158

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a90f37e3d7acfd9824f162830583bbf7846fe252,d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644)`	affected	code_commit	—
`[858e74876c5cbff1dfd5bace99e32fbce2abd4b5,b862996e5105be1293da9cdc85da77b76021c3bd)`	affected	code_commit	—
`[858e74876c5cbff1dfd5bace99e32fbce2abd4b5,2f8ed71aaaba3bc8b19cd9930cc62e63e142b299)`	affected	code_commit	—
`[858e74876c5cbff1dfd5bace99e32fbce2abd4b5,eac6917a42899aad0617bbf04798c5dd946a1fe5)`	affected	code_commit	—
`[858e74876c5cbff1dfd5bace99e32fbce2abd4b5,b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc)`	affected	code_commit	—
`[6.6.32,6.6.158)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	generic	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the parse_posix_sids() bounds‑check fix.
Configure firewall rules or network policies to allow SMB client traffic only from trusted internal hosts.
If an immediate kernel update is not feasible, consider disabling the SMB client or blocking SMB traffic from external networks until the patch is applied.

Generated by OpenCVE AI on October 24, 2026 at 15:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00478.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98405.mbox
https://git.kernel.org/stable/c/2f8ed71aaaba3bc8b19cd9930cc62e63e142b299
https://git.kernel.org/stable/c/b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc
https://git.kernel.org/stable/c/b862996e5105be1293da9cdc85da77b76021c3bd
https://git.kernel.org/stable/c/d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644
https://git.kernel.org/stable/c/eac6917a42899aad0617bbf04798c5dd946a1fe5
https://nvd.nist.gov/vuln/detail/CVE-2026-98405
https://www.cve.org/CVERecord?id=CVE-2026-98405

History

Sat, 24 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H'}`

Fri, 16 Oct 2026 23:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-788

Fri, 16 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98405.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98405 https://www.cve.org/CVERecord?id=CVE-2026-98405
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Thu, 15 Oct 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-788

Wed, 14 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len). If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory. Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.
Title		smb: client: fix missing iov bounds check in parse_posix_sids()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2f8ed71aaaba3bc8b19cd9930cc62e63e142b299 https://git.kernel.org/stable/c/b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc https://git.kernel.org/stable/c/b862996e5105be1293da9cdc85da77b76021c3bd https://git.kernel.org/stable/c/d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644 https://git.kernel.org/stable/c/eac6917a42899aad0617bbf04798c5dd946a1fe5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-14T13:27:40.589Z

Updated: 2026-10-24T14:08:44.159Z

Reserved: 2026-09-25T10:25:14.347Z

Link: CVE-2026-98405

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-14T14:17:51.603

Modified: 2026-10-24T14:16:40.877

Link: CVE-2026-98405

Redhat

Severity : Moderate

Publid Date: 2026-10-14T00:00:00Z

Links: CVE-2026-98405 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T15:30:14Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction Required

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object