CVE-2026-98167
smb: client: fix server->total_read for compound encrypted PDUs
No known exploitation. EPSS puts it in the 11th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ b24df3e30cbf48255db866720fb71f14bf9d2f39, < 8703539d22fdbc13dd2db090ee199c3a427b8ea0Upgrade to: 8703539d22fdbc13dd2db090ee199c3a427b8ea0Affected: ≥ b24df3e30cbf48255db866720fb71f14bf9d2f39, < e78fc1d240b27349b45a0f1c3e3c2c401d7e230dUpgrade to: e78fc1d240b27349b45a0f1c3e3c2c401d7e230dAffected: ≥ b24df3e30cbf48255db866720fb71f14bf9d2f39, < a46eb242e9eef3a3897d166748b23303c516e870Upgrade to: a46eb242e9eef3a3897d166748b23303c516e870Affected: ≥ b24df3e30cbf48255db866720fb71f14bf9d2f39, < ebb8a075fdc7af3d196a4f158a0e18dbc394c0e3Upgrade to: ebb8a075fdc7af3d196a4f158a0e18dbc394c0e3 + 2 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server->total_read for compound encrypted PDUs In receive_encrypted_standard(), server->total_read is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result, cifs_handle_standard() passes this full size to smb2_check_message(), causing the PDU length guards to incorrectly validate the entire compound frame instead of the current sub-PDU. This allows truncated non-last sub-PDUs to bypass length validation, leading to out-of-bounds reads in smb2_get_data_area_len(). Fix this by setting server->total_read to the true length of the current sub-PDU: next_cmd for non-last sub-PDUs, and the remaining pdu_length for the last one.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 11th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/8703539d22fdbc13dd2db090ee199c3a427b8ea0
- git.kernel.org/stable/c/e78fc1d240b27349b45a0f1c3e3c2c401d7e230d
- git.kernel.org/stable/c/a46eb242e9eef3a3897d166748b23303c516e870
And 3 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI