Cloudanix VulnDB

CVE-2026-98167

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in handling certain encrypted network messages could let attackers read memory they should not access, risking crashes or data leaks during file sharing.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect server->total_read value left at full decrypted frame size for sub-PDUs in receive_encrypted_standard() causes smb2_check_message() to validate entire compound frame instead of current sub-PDU, allowing truncated non-last sub-PDUs to bypass guards and trigger out-of-bounds reads in smb2_get_data_area_len().

Why it matters to the business

Memory corruption in SMB client handling can cause system instability, crashes during file sharing, or potential information disclosure affecting network storage operations.

How an attack unfolds

An attacker crafts a compound encrypted SMB PDU containing a truncated non-last sub-PDU; due to the total_read mishandling the client performs incorrect length checks and reaches an out-of-bounds read during data area processing.

How to fix it

Apply the upstream kernel patch that correctly sets server->total_read to next_cmd for non-last sub-PDUs and remaining pdu_length for the last sub-PDU in receive_encrypted_standard().

How to confirm the fix worked

Inspect kernel source for updated receive_encrypted_standard() logic that assigns server->total_read per sub-PDU; confirm absence of the prior full-frame assignment for compound encrypted frames.

Typical attack path

  1. Craft malicious compound encrypted SMB PDU with truncated non-last sub-PDU
  2. Send PDU to vulnerable Linux SMB client
  3. Trigger receive_encrypted_standard() and smb2_check_message() path
  4. Induce out-of-bounds read in smb2_get_data_area_len()

How to detect it

Review kernel logs for cifs module crashes or warnings around smb2_check_message and smb2_get_data_area_len during encrypted compound PDU processing; correlate with unusual inbound SMB traffic patterns.

What your security team should do

  • Prioritize kernel updates containing the smb client compound PDU fix
  • Monitor upstream stable branches for backports
  • Test SMB client workloads after patching to verify stability

The record

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix server->total_read for compound encrypted PDUs In receive_encrypted_standard(), server->total_read is left at the full decrypted frame size when walking sub-PDUs of a compound encrypted frame. As a result, cifs_handle_standard() passes this full size to smb2_check_message(), causing the PDU length guards to incorrectly validate the entire compound frame instead of the current sub-PDU. This allows truncated non-last sub-PDUs to bypass length validation, leading to out-of-bounds reads in smb2_get_data_area_len(). Fix this by setting server->total_read to the true length of the current sub-PDU: next_cmd for non-last sub-PDUs, and the remaining pdu_length for the last one.

Affected packages

Ecosystem Package Introduced Fixed