CVE-2026-98170

What it actually does

Insufficient bounds check in move_smb2_ea_to_cifs() allows the while (src_size > 0) loop to dereference ea_name_length and ea_value_length fields of an smb2_ea_info structure when remaining src_size is smaller than the structure size, resulting in an out-of-bounds read.

Why it matters to the business

Linux SMB clients may experience kernel memory disclosure or crashes when connecting to a server that returns a malformed extended attribute list, potentially disrupting file access or exposing sensitive kernel memory.

How an attack unfolds

An attacker hosts a malicious SMB server that replies to SMB2 QUERY_INFO or similar requests with an EA list whose total size or next_entry_offset values are crafted to be smaller than sizeof(smb2_ea_info). When the client invokes move_smb2_ea_to_cifs() on this response, the loop condition permits reads past the supplied buffer, triggering the out-of-bounds access.

How to fix it

Apply the upstream kernel patch that adds src_size >= sizeof(*src) guard before reading fields and validates next_entry_offset against both structure size and remaining buffer length. Rebuild and deploy the updated kernel; for distributions, install the corresponding security update once available.

How to confirm the fix worked

Confirm the patched kernel source contains the size check before the while loop and the next_entry_offset sanity tests; test by replaying a deliberately malformed EA response and verifying -EIO is returned instead of previous error codes or a crash.

Typical attack path

1. Attacker configures SMB server to return a malformed EA list with insufficient length or invalid next_entry_offset
2. Victim Linux client mounts the share or issues getxattr/listxattr operations
3. Kernel processes the server response and calls move_smb2_ea_to_cifs()
4. Loop iterates without adequate size validation, performing out-of-bounds reads of EA structure fields
5. Kernel returns -EIO to userspace or experiences memory corruption effects

How to detect it

Examine kernel logs for oops or panic messages referencing move_smb2_ea_to_cifs or smb2_ea_info; audit SMB client activity logs for repeated connections to untrusted servers followed by -EIO errors on xattr operations.

What your security team should do

• Prioritize kernel updates for all Linux systems that mount SMB shares
• Monitor vendor security advisories for the specific distribution kernel package containing this fix
• Consider network segmentation or SMB server allow-listing until patches are deployed
• Review SMB client configurations to restrict unnecessary extended attribute usage where feasible