IT SBIT Services
Schneeberger
DEEN
CVE tracker

Linux kernel SMB client: Out-of-bounds read in create context parsing

CVE-2026-98454High 8.1

← All vulnerabilities

Summary

The SMB client of the Linux kernel does not limit SMB2/SMB3 create context records to their Next field before dispatching them, and it parses lease contexts at fixed offsets instead of the declared DataOffset. A malicious or compromised SMB server can send a crafted response that makes the client read bytes beyond the current context. The issue matters where Linux hosts mount SMB/CIFS shares from servers outside your control. NVD has not yet published a score; the 8.1 in the input is unconfirmed, and VulDB rates the issue 6.3 (Medium).

Affected

  • Linux kernel versions from 3.7 onward, per the CNA record, until fixed
  • Stable branches 5.10, 5.15, 6.1, 6.6, 6.12, 6.18 and 7.2 before the fixed versions below
  • Ubuntu 20.04 LTS and 22.04 LTS are listed as vulnerable

Fixed in

  • Stable kernels 5.10.273, 5.15.224, 6.1.191, 6.6.158, 6.12.112, 6.18.55 and 7.2.9 or later
  • Upstream fix commits: 05a7fd80, 0a8c2a67, 28bc9a87, 34245048, 43d0ca48, 67f4c1c6, cecc5399, e4c49012
  • Mainline 7.3: Unknown.

Workaround

  • No vendor workaround documented.
  • If SMB/CIFS mounts are not needed, make sure the cifs module is not loaded.
  • Limit CIFS mounts to trusted servers.

Exploitation

  • No exploitation in the wild known.
  • No public proof of concept found.
  • VulDB marks the exploit status as 0-day without evidence of active use.

Our recommendation

  • Update Linux kernels to a fixed stable version as soon as your distribution ships it, prioritising hosts that mount remote SMB shares.
  • Check whether your distribution has released the fix; Ubuntu 20.04 and 22.04 were still listed as vulnerable.
  • Limit SMB mounts to trusted servers and unload the cifs module where it is not needed.
  • Monitor the NVD score and the CNA statement for changes.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:47.

Original description (NVD)

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes beyond the current context to a handler. The QFid handler also used a full response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same layout assumption: they read LeaseState and LeaseFlags at canonical offsets rather than at DataOffset. A valid non-canonical DataOffset could therefore yield unrelated in-bounds data, while a short DataLength was still accepted. Limit each context to its Next value, reject offsets before the context header, and reject malformed chains. Bound the name range by the current context and do not dispatch a known handler when DataLength is zero. Read the QFid DiskFileId only when the context data covers that field. Parse the lease context from DataOffset and require DataLength to match the v1 or v2 lease_context size used by ksmbd. A size mismatch skips lease parsing without failing the open.

NVD references (8)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed