CVE-2026-98170smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds. Fix this by ensuring src_size >= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer. Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating "attribute not present" or "output buffer too small".
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 24 days later
· 24 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 88% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 95907fea4fd8ccc736e0a428e52159b4d42b9958 – < 22886b1b7464613373c9a7d0af2ace029c50cd97
- affected 95907fea4fd8ccc736e0a428e52159b4d42b9958 – < 9d707a278c100c26d10fbbbd03988778ffc992ce
- affected 95907fea4fd8ccc736e0a428e52159b4d42b9958 – < 90a13af4c9b1369327395bababfe87c75599cc19
- affected 95907fea4fd8ccc736e0a428e52159b4d42b9958 – < 61812323c037a94e2e7f0db7ee740c34b126bffe
- affected 95907fea4fd8ccc736e0a428e52159b4d42b9958 – < d3546cecbf81d98bf3b472d341f981eb48c04f47
- affected 95907fea4fd8ccc736e0a428e52159b4d42b9958 – < 34a3942e787b9c59758115bd65fe1ec89d68c7a4
- affected 95907fea4fd8ccc736e0a428e52159b4d42b9958 – < 13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca
- affected 95907fea4fd8ccc736e0a428e52159b4d42b9958 – < eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb
- affected 4.14
- unaffected < 4.14
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.54 – ≤ 6.18.*
- unaffected 7.2.8 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/22886b1b7464613373c9a7d0af2ace029c50cd97 (opens in a new tab)
- https://git.kernel.org/stable/c/9d707a278c100c26d10fbbbd03988778ffc992ce (opens in a new tab)
- https://git.kernel.org/stable/c/90a13af4c9b1369327395bababfe87c75599cc19 (opens in a new tab)
- https://git.kernel.org/stable/c/61812323c037a94e2e7f0db7ee740c34b126bffe (opens in a new tab)
- https://git.kernel.org/stable/c/d3546cecbf81d98bf3b472d341f981eb48c04f47 (opens in a new tab)
- https://git.kernel.org/stable/c/34a3942e787b9c59758115bd65fe1ec89d68c7a4 (opens in a new tab)
- https://git.kernel.org/stable/c/13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca (opens in a new tab)
- https://git.kernel.org/stable/c/eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-93098 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98170)Record last updated .