{"id":"CVE-2026-98454","kind":"vulnerability","aliases":["CVE-2026-98454"],"related":[],"title":"Linux kernel SMB client: malformed create context reads out-of-bounds memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it.  A\nmalformed chain can therefore expose bytes beyond the current context to\na handler.  The QFid handler also used a full response-structure cast\nalthough it only reads DiskFileId.\n\nThe SMB2/SMB3 lease parsers made the same layout assumption: they read\nLeaseState and LeaseFlags at canonical offsets rather than at\nDataOffset.  A valid non-canonical DataOffset could therefore yield\nunrelated in-bounds data, while a short DataLength was still accepted.\n\nLimit each context to its Next value, reject offsets before the context\nheader, and reject malformed chains.  Bound the name range by the current\ncontext and do not dispatch a known handler when DataLength is zero.  Read\nthe QFid DiskFileId only when the context data covers that field.  Parse the\nlease context from DataOffset and require DataLength to match the v1 or v2\nlease_context size used by ksmbd.  A size mismatch skips lease parsing\nwithout failing the open.","summary":"The Linux kernel SMB client parses SMB2/SMB3 create contexts without limiting each record to its Next field, and reads lease contexts at canonical rather than declared offsets. A malicious SMB server or malformed response can therefore make the client read bytes beyond the current context, exposing kernel memory to a handler.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","kernel","linux","package","self-hosted","smb"],"not_affected_if":["cifs-module-not-loaded","no-smb-mounts"],"how_to_check":"- Run `uname -r` and check whether the kernel includes the fix for smb: client: fix create context out-of-bounds reads\n- Check whether the cifs or smb client module is loaded with `lsmod | grep -E 'cifs|smb'`\n- Check whether SMB mounts are in use with `mount -t cifs,smb3`","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing smb: client: fix create context out-of-bounds reads, per your distribution's advisory\n- Until patched, avoid mounting SMB shares from untrusted servers","status":"open","published_at":"2026-10-18T16:16:55+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:27:22+00:00","updated_at":"2026-10-25T05:27:22+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:27:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing smb: client: fix create context out-of-bounds reads, per your distribution's advisory\n- Until patched, avoid mounting SMB shares from untrusted servers","reach":"network","title":"Linux kernel SMB client: malformed create context reads out-of-bounds memory","impact":"low","summary":"The Linux kernel SMB client parses SMB2/SMB3 create contexts without limiting each record to its Next field, and reads lease contexts at canonical rather than declared offsets. A malicious SMB server or malformed response can therefore make the client read bytes beyond the current context, exposing kernel memory to a handler.","category":"package","nicknames":[],"who_cares":["linux","kernel","smb","cifs","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel memory beyond a create context may be read by a handler","analyst_note":"Find the upstream kernel commit and affected version ranges at the NVD link, and whether a distro advisory lists fixed versions.","how_to_check":"- Run `uname -r` and check whether the kernel includes the fix for smb: client: fix create context out-of-bounds reads\n- Check whether the cifs or smb client module is loaded with `lsmod | grep -E 'cifs|smb'`\n- Check whether SMB mounts are in use with `mount -t cifs,smb3`","needs_analyst":true,"not_affected_if":["no-smb-mounts","cifs-module-not-loaded"],"who_is_affected":"Systems that mount SMB/CIFS shares with the Linux kernel client, especially against servers that are not fully trusted. Systems without the cifs/smb client module loaded or that never mount SMB shares are unlikely to be exposed. The sources do not say which kernel versions are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.0007,"input_tokens":3610,"output_tokens":678,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98454':16A,19A 'accept':193C 'also':139C 'although':147C 'area':108C 'assumpt':160C 'beyond':69B,129C 'bound':12A,97C,185C,211C 'byte':68B,128C 'canon':50B,167C,177C 'cast':146C 'chain':124C,210C 'cif':20B 'client':4A,32B,66B,90C 'complet':104C 'context':7A,36B,48B,72B,93C,101C,107C,132C,196C,205C,218C,237C,245C,258C 'could':179C 'cover':239C 'creat':6A,35B,92C,106C 'create-context':105C 'current':71B,131C,217C 'cve':14A,17A 'data':186C,238C 'datalength':190C,227C,250C 'dataoffset':172C,178C,247C 'declar':53B 'diskfileid':151C,233C 'dispatch':120C,222C 'expos':73B,127C 'fail':270C 'field':44B,118C,241C 'fix':91C 'follow':84C 'full':142C 'handler':78B,135C,138C,225C 'header':206C 'host':26B 'in-bound':183C 'kernel':2A,21B,30B,74B,82C 'known':224C 'ksmbd':262C 'layout':159C 'leas':47B,154C,244C,257C,267C 'leaseflag':165C 'leasest':163C 'limit':38B,112C,194C 'linux':1A,22B,29B,81C 'made':156C 'make':64B 'malform':5A,60B,123C,209C 'malici':56B 'match':252C 'memori':13A,75B 'mismatch':265C 'name':213C 'next':43B,117C,199C 'non':176C 'non-canon':175C 'offset':54B,168C,202C 'open':272C 'out-of-bound':9A,94C 'packag':23B 'pars':33B,100C,242C,268C 'parser':155C 'qfid':137C,232C 'rang':214C 'rather':51B,169C 'read':8A,46B,67B,98C,150C,162C,230C 'record':40B,114C 'reject':201C,208C 'requir':249C 'resolv':88C 'respons':61B,144C 'response-structur':143C 'self':25B 'self-host':24B 'server':58B 'short':189C 'size':259C,264C 'skip':266C 'smb':3A,27B,31B,57B,89C 'smb2':99C 'smb2/smb3':34B,153C 'still':192C 'structur':145C 'therefor':63B,126C,180C 'unrel':182C 'use':140C,260C 'v1':254C 'v2':256C 'valid':102C,174C 'valu':200C 'vulner':85C 'without':37B,269C 'yield':181C 'zero':229C","nicknames":[],"mitigations":[],"who_affected":"Systems that mount SMB/CIFS shares with the Linux kernel client, especially against servers that are not fully trusted. Systems without the cifs/smb client module loaded or that never mount SMB shares are unlikely to be exposed. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98454","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98454","severity":null,"published_at":"2026-10-18T16:16:55+00:00","modified_at":"2026-10-19T10:18:54+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}