CVE-2026-98169
High · 7.1CVSS
7.1
EPSS
0.4%
Published
Oct 6, 2026
CISA due date
—
Cloudanix analysis
A flaw in Linux systems that talk to file servers can let a bad server steal small pieces of the computer's internal memory, which might contain passwords or other secrets.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Information Disclosure
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds read in smb3_enum_snapshots() allows kernel to copy more data than the allocated retbuf size when server returns a short SMB2 ioctl reply, leaking adjacent slab memory to userspace via copy_to_user().
Why it matters to the business
Attackers with network access to an SMB server can obtain fragments of kernel memory from client systems, potentially exposing sensitive data such as credentials or encryption keys and increasing risk of further compromise.
How an attack unfolds
An attacker positions a malicious SMB server that returns an SMB2 ioctl response with OutputCount smaller than sizeof(struct smb_snapshot_array). The Linux SMB client allocates retbuf to exactly that length, sets ret_data_len without bounds checking, and performs an oversized copy_to_user() that reads past the buffer end into adjacent slab memory.
How to fix it
Apply the upstream kernel patch that rejects SMB2 ioctl replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Reboot affected systems after installing the fixed kernel.
How to confirm the fix worked
Confirm the running kernel contains the commit that adds the length check before copy_to_user() in smb3_enum_snapshots(). Monitor for kernel builds dated after 2026-10-06 that include the fix.
Typical attack path
- Attacker controls or compromises an SMB server reachable by the victim client.
- Victim client issues an SMB3 snapshot enumeration request.
- Malicious server replies with a short OutputCount value.
- Kernel performs unbounded copy_to_user() leaking slab memory.
- Leaked data is returned to userspace application or attacker-controlled process.
How to detect it
Review audit logs and system call traces for SMB2 ioctl responses triggering EIO errors in snapshot enumeration paths; inspect userspace processes receiving unexpected kernel memory contents.
What your security team should do
- Prioritize kernel updates on all Linux SMB clients within the next 30 days.
- Restrict SMB client connections to trusted servers only.
- Enable kernel memory leak detection tooling and review audit logs for unusual copy_to_user() patterns.
The record
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual length of the server's reply. Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in ret_data_len exceeding the size of retbuf. The subsequent copy_to_user() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces ret_data_len. Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copy_to_user() attempts to read.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|