CVE-2026-98171
High · 8.8CVSS
8.8
EPSS
0.5%
Published
Oct 6, 2026
CISA due date
—
Cloudanix analysis
A flaw in how Linux handles certain network file transfers could let attackers crash systems or run malicious code without user interaction.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in receive_encrypted_standard() due to stale next_buffer pointer after assignment to server->bigbuf on error paths, combined with incorrect pdu_length (pre-decryption size) allowing NextCommand to reference stale ciphertext and insufficient bounds checks on next_cmd values.
Why it matters to the business
Remote attackers may corrupt memory in SMB client handling of compound encrypted frames, leading to crashes, denial of service, or potential code execution that disrupts file sharing, authentication, and network services on Linux systems.
How an attack unfolds
An attacker sends a crafted compound encrypted SMB PDU with manipulated NextCommand values that trigger error paths after next_buffer assignment, exploiting the stale pointer and integer overflow in bounds checking to achieve use-after-free.
How to fix it
Apply the upstream Linux kernel patch that clears next_buffer after assignment, updates pdu_length to decrypted size, rejects next_cmd smaller than MID_HEADER_SIZE, and fixes the integer overflow check; rebuild and deploy updated kernels across affected systems.
How to confirm the fix worked
Confirm kernel source contains the described fixes for next_buffer clearing, pdu_length update, next_cmd validation, and overflow check; test with compound encrypted PDU test cases and verify no UAF in receive_encrypted_standard().
Typical attack path
- Establish SMB connection to target Linux client
- Send specially crafted compound encrypted frame with invalid next_cmd
- Trigger error handling that reuses stale next_buffer pointer
- Achieve use-after-free for memory corruption or control flow hijack
How to detect it
Inspect kernel logs for oops or panic messages referencing smb receive_encrypted_standard or next_buffer; correlate with inbound SMB traffic containing compound encrypted PDUs; review audit logs for unexpected SMB client crashes.
What your security team should do
- Prioritize kernel updates for all Linux systems using SMB client functionality
- Monitor upstream kernel changelogs for related SMB fixes
- Restrict SMB client exposure to untrusted servers until patched
- Review logging for SMB receive errors as temporary detection measure
The record
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames: - Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths. - Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject next_cmd values smaller than MID_HEADER_SIZE(server). - Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|