Executive brief
The Linux kernel's SMB client component contains a buffer overflow vulnerability in its oplock break validation function. A flaw in the bounds check allows malformed SMB messages received over the network to bypass validation, potentially permitting remote code execution or information disclosure on systems that mount SMB file shares.
Technical details
The vulnerability is a bounds check bypass in the is_valid_oplock_break() function in fs/smb/client/smb1misc.c. A prior commit (83bfbd0bb902) changed how the SMB message length was calculated, but the data_offset validation bound was not updated correctly. The bound calculation becomes identically zero due to incorrect subtraction (srv->total_read - srv->pdu_size), which causes the check added in commit 097f5863b1a0 to be ineffective. This allows out-of-bounds DataOffset values to pass validation. The fix restores the bound to use srv->total_read directly. Attack requires network connectivity to an SMB client; no user interaction is required. An attacker sending a crafted SMB response can trigger the overflow.
Affected products
- Linux Linux kernel all versions from introduction of commit 83bfbd0bb902 until patched
Timeline
- 2026-09-11: disclosed
- 2026-08-24: patched