Executive brief
A vulnerability in the Linux kernel's SMB client could allow a malicious or compromised server to send specially crafted responses that bypass security checks. This occurs when the client incorrectly processes overlapping data areas in network messages, potentially leading to memory corruption or system instability. Users should update their Linux kernel to a patched version to ensure secure communication with file servers.
Technical details
A vulnerability exists in the Linux kernel SMB client's handling of SMB2 responses. Specifically, the function `__smb2_calc_size()` in `fs/smb/client/smb2misc.c` clears the `data_length` field when it detects an overlap between the data area and the fixed header. This behavior can cause an invalid response to be incorrectly identified as having no data area, allowing it to bypass length compatibility exceptions introduced in previous commits. An attacker controlling a malicious SMB server could exploit this to send malformed responses that the client fails to reject. The fix involves tracking data area overlaps separately and explicitly rejecting such responses before applying length exceptions.
Affected products
- Linux Linux Kernel 5.10.261, 5.15.212, 7.2-rc3
Timeline
- 2026-07-25: disclosed: Initial publication of the vulnerability details.
- 2026-07-25: advisory: NVD published the CVE record.
References
- https://git.kernel.org/stable/c/36bfa52459e45c0d5b668de2f1c91f6dc5c67775
- https://git.kernel.org/stable/c/445ece263131780dee273d727a4d6f11934feec7
- https://git.kernel.org/stable/c/4a9d2657d3e05f6ed09c148cb127b4e58702275f
- https://git.kernel.org/stable/c/57cba95f0e97c6f6e45e6731da30aff091bd7460
- https://git.kernel.org/stable/c/8986c932905ea508d66da421eb2eb6e676ace1fe
- https://git.kernel.org/stable/c/fdafa1e68dc75045b7b617e6e7d2854950804d83