CVE-2024-26828

What it actually does

Type mismatch between ssize_t bytes_left and size_t sizeof() in parse_server_interfaces() causes unsigned promotion, so a negative bytes_left value keeps the loop running instead of terminating, leading to improper input validation on CIFS server interface buffers.

Why it matters to the business

Organizations running affected Linux kernels with CIFS mounts face potential crashes or memory corruption when connecting to untrusted servers; urgency is low given no known exploitation and stable EPSS, but kernel updates remain necessary for long-term stability across mailcow and upstream deployments.

How an attack unfolds

An attacker supplies a crafted CIFS server interface response that triggers negative bytes_left; the flawed comparison allows continued buffer processing, potentially resulting in out-of-bounds access or denial of service during mount operations.

How to fix it

Update to fixed commits 7190353835b4a219abb70f90b06cdcae97f11512 (upstream) or 552f09f48aacda3a14238101c8a0f4c922ffe65f (mailcow-dockerized); rebuild and reboot affected kernels, or apply vendor backports for supported distributions.

How to confirm the fix worked

Confirm the presence of the correcting commit in the running kernel source, verify bytes_left comparison uses ssize_t consistently, and test CIFS mounts against servers returning minimal or zero-length interface buffers.

Typical attack path

1. Identify a target using CIFS mounts from the vulnerable kernel
2. Position a malicious or compromised SMB server that returns a malformed interface list
3. Trigger connection or reconnection to the server
4. Induce the parse_server_interfaces() loop to underflow and continue on negative size

How to detect it

Review kernel logs for CIFS parse errors or oops messages around server interface processing; examine network captures of SMB negotiate or tree-connect responses for unusually small or malformed interface lists.

What your security team should do

• Prioritize kernel upgrades on all systems exposing CIFS clients within the next maintenance window
• Monitor upstream stable branches for additional related fixes
• Restrict CIFS mounts to trusted servers until patches are applied