Is CVE-2026-98405 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-98405 being exploited in the wild.

How severe is CVE-2026-98405?

Informational severity, published 14 October 2026.

Which products and versions are affected?

Linux kernel from 6.0 through 6.10+, 5.15+, and stable branches with the vulnerable parse_posix_sids() code.

Is there a fix for CVE-2026-98405?

A patch was published on 2026-09-17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-98405 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-98405?

Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-98405: Linux kernel out-of-bounds read in SMB client parse_posix_sids()

CVE-2026-98405 · Severity: info · Published 2026-10-14

The Linux kernel's SMB client implementation contains an out-of-bounds memory read vulnerability in the parse_posix_sids() function. A malicious or compromised SMB server can send a specially crafted response with an inflated length field to trigger reads from kernel memory beyond the received buffer, potentially exposing sensitive kernel data. This affects systems that mount SMB shares and could be exploited to leak kernel information or cause denial of service.

Technologies: Linux kernel.

Quick answers

Is CVE-2026-98405 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-98405 being exploited in the wild.
How severe is CVE-2026-98405?: Informational severity, published 14 October 2026.
Which products and versions are affected?: Linux kernel from 6.0 through 6.10+, 5.15+, and stable branches with the vulnerable parse_posix_sids() code.
Is there a fix for CVE-2026-98405?: A patch was published on 2026-09-17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-98405 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-98405?: Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The parse_posix_sids() function in fs/smb/client/smb2inode.c fails to validate that a server-supplied out_len value does not exceed the actual length of the received I/O vector (iov_len). When sidsbuf_end is calculated from an untrusted server value, it can point past the iov boundary or wrap around, defeating subsequent bounds checks in posix_info_sid_size(). The fix adds validation to reject responses where sidsbuf_end would exceed iov boundaries or cause pointer wraparound, returning -EINVAL if either condition is detected.

Affected products

Linux kernel from 6.0 through 6.10+, 5.15+, and stable branches with the vulnerable parse_posix_sids() code

Timeline

2026-10-14: disclosed
2026-09-17: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.