CVE Tools
Track your stack

CVE-2026-98169

smb: client: fix potential OOB read in smb3_enum_snapshots()

No known exploitation. EPSS puts it in the 36th percentile. Fixed versions are out.

CVSS 3.17.1HighEPSS percentile36th0.4% chance in 30 daysCISA KEVNot listedNo confirmed exploitation
No public exploit knownFix1 product4 fixed builds listed below

Published Updated Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

  • LinuxAffected: ≥ e02789a53d71334b067ad72eee5d4e88a0158083, < 15a221c734b9d044ab769e7e3606b2cab96fb65aUpgrade to: 15a221c734b9d044ab769e7e3606b2cab96fb65aAffected: ≥ e02789a53d71334b067ad72eee5d4e88a0158083, < 74995ee8305a7c4d76ee70d6acd996a75eda3c03Upgrade to: 74995ee8305a7c4d76ee70d6acd996a75eda3c03Affected: ≥ e02789a53d71334b067ad72eee5d4e88a0158083, < 210f0f1f67817e7d2348b86b5115a9b85ef5c98bUpgrade to: 210f0f1f67817e7d2348b86b5115a9b85ef5c98bAffected: ≥ e02789a53d71334b067ad72eee5d4e88a0158083, < 1cdf0d304d820fb13bf0faf532c3459600f9ea43Upgrade to: 1cdf0d304d820fb13bf0faf532c3459600f9ea43 + 8 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual length of the server's reply. Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in ret_data_len exceeding the size of retbuf. The subsequent copy_to_user() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces ret_data_len. Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copy_to_user() attempts to read.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS36th
CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 36th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

3 events over 1 day, from the signal feeds we watch.

  1. Record updated
  2. Publishedrecord updated

Affected products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Scored 7.1 by NVD.

How it is reached

  • Attack Vector NetworkExploitable remotely over the network without any special conditions
  • Attack Complexity LowNo special conditions — the attack can be reliably reproduced
  • Privileges Required NoneNo authentication required — anyone can exploit this
  • User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

  • Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

  • Confidentiality LowSome restricted information is disclosed, but limited in scope
  • Integrity NoneNo integrity impact
  • Availability HighTotal denial of service — the component is completely unavailable

Sources

References in the record

And 3 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.