Linux Kernel Vulnerability Affecting SMB Client Functionality

CVE-2026-98405

What is CVE-2026-98405?

A vulnerability in the Linux kernel's SMB client functionality can allow an attacker to exploit improperly validated input, specifically within the parse_posix_sids() function. This issue arises due to a lack of boundary checks on the server-supplied out_len parameter, which, if manipulated by a malicious server, can lead to sidsbuf_end pointing beyond the actual data received in the input vector (iov). Consequently, this could enable unauthorized access to adjacent kernel memory, allowing for potential memory exploitation and breach of system integrity. To mitigate this risk, strict validation protocols have been introduced to reject any responses where the calculated buffer end exceeds the actual lengths or leads to pointer wraparound.

References