CVE-2026-98405: Linux kernel: Out-of-bounds read in SMB client POSIX SID parsing

Summary

The SMB/CIFS client of the Linux kernel does not check the length of the server-supplied data in parse_posix_sids() against the received buffer. A malicious or compromised SMB server can send an inflated length value and cause out-of-bounds reads into adjacent kernel memory. The attack requires that a Linux client connects to a malicious server, and the sources describe user interaction as required.

Affected

Linux kernel versions per CNA data: 6.6.32 up to before 6.6.158, and the 6.7 and 6.8 series up to their fixed releases
Version ranges in OSV and CNA data differ and are backported by distributions; check the distribution advisory for the exact status.
Affected kernel versions with CIFS/SMB client support enabled

Fixed in

Upstream fixed versions: 6.6.158, 6.12.112, 6.18.54, 7.2.8
Distribution kernels: use the fixed package from your distribution. Unknown for specific releases, as the sources did not confirm the status.

Workaround

No vendor workaround documented.
Unloading the cifs module on hosts that do not need SMB mounts removes the exposed code path (own suggestion, not from a vendor source).

Exploitation

Unknown. No public exploit or active exploitation was found in the sources.

Our recommendation

Identify systems with Linux kernels that use the SMB/CIFS client and check their kernel versions.
Install the fixed kernel from your distribution or the upstream stable release and reboot.
Where SMB mounts are not needed, disable the cifs module.
Only mount SMB shares from trusted servers until the patch is applied.
Monitor kernel and distribution security advisories for updates.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

OSV: CVE-2026-98405 osv.dev
Kernel.org stable commit 2f8ed71a git.kernel.org
Kernel.org stable commit b09d092e git.kernel.org
Kernel.org stable commit b862996e git.kernel.org
Kernel.org stable commit d91b9a3b git.kernel.org
Kernel.org stable commit eac6917a git.kernel.org
Ubuntu security notice CVE-2026-98405 ubuntu.com
Red Hat CVE record via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:07.

Original description (NVD)

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len). If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory. Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed