---
id: "CVE-2026-98454"
kind: "vulnerability"
aliases: ["CVE-2026-98454"]
title: "Linux kernel SMB client: malformed create context reads out-of-bounds memory"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cifs", "kernel", "linux", "package", "self-hosted", "smb"]
not_affected_if: ["cifs-module-not-loaded", "no-smb-mounts"]
published_at: "2026-10-18T16:16:55+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:27:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98454", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel SMB client: malformed create context reads out-of-bounds memory

The Linux kernel SMB client parses SMB2/SMB3 create contexts without limiting each record to its Next field, and reads lease contexts at canonical rather than declared offsets. A malicious SMB server or malformed response can therefore make the client read bytes beyond the current context, exposing kernel memory to a handler.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and check whether the kernel includes the fix for smb: client: fix create context out-of-bounds reads
- Check whether the cifs or smb client module is loaded with `lsmod | grep -E 'cifs|smb'`
- Check whether SMB mounts are in use with `mount -t cifs,smb3`

## Fix

- Update the Linux kernel to a release that includes the upstream commit fixing smb: client: fix create context out-of-bounds reads, per your distribution's advisory
- Until patched, avoid mounting SMB shares from untrusted servers

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98454

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix create context out-of-bounds reads

smb2_parse_contexts() validates the complete create-context area but
does not limit each record to its Next field before dispatching it.  A
malformed chain can therefore expose bytes beyond the current context to
a handler.  The QFid handler also used a full response-structure cast
although it only reads DiskFileId.

The SMB2/SMB3 lease parsers made the same layout assumption: they read
LeaseState and LeaseFlags at canonical offsets rather than at
DataOffset.  A valid non-canonical DataOffset could therefore yield
unrelated in-bounds data, while a short DataLength was still accepted.

Limit each context to its Next value, reject offsets before the context
header, and reject malformed chains.  Bound the name range by the current
context and do not dispatch a known handler when DataLength is zero.  Read
the QFid DiskFileId only when the context data covers that field.  Parse the
lease context from DataOffset and require DataLength to match the v1 or v2
lease_context size used by ksmbd.  A size mismatch skips lease parsing
without failing the open.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_