CVE-2026-98405smb: client: fix missing iov bounds check in parse_posix_sids()
- 8.1HighCVSS base score
- 0.48%Exploitation in 30 daysEPSS · top 58% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len). If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory. Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.
Timeline
ID reserved
By Linux
- 19 days later
· 19 days later
Published
- 10 days later
· 10 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
| NVDNVD · Received | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.48% · top 58% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Affected products
- affected a90f37e3d7acfd9824f162830583bbf7846fe252 – < d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644
- affected 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 – < b862996e5105be1293da9cdc85da77b76021c3bd
- affected 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 – < 2f8ed71aaaba3bc8b19cd9930cc62e63e142b299
- affected 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 – < eac6917a42899aad0617bbf04798c5dd946a1fe5
- affected 858e74876c5cbff1dfd5bace99e32fbce2abd4b5 – < b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc
- affected 6.6.32 – < 6.6.158
- affected 6.8
- unaffected < 6.8
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.54 – ≤ 6.18.*
- unaffected 7.2.8 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References5
- https://git.kernel.org/stable/c/d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644 (opens in a new tab)
- https://git.kernel.org/stable/c/b862996e5105be1293da9cdc85da77b76021c3bd (opens in a new tab)
- https://git.kernel.org/stable/c/2f8ed71aaaba3bc8b19cd9930cc62e63e142b299 (opens in a new tab)
- https://git.kernel.org/stable/c/eac6917a42899aad0617bbf04798c5dd946a1fe5 (opens in a new tab)
- https://git.kernel.org/stable/c/b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-101054 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98405)Record last updated .