CVE-2026-98454
NoneCVSS
—
EPSS
0.2%
Published
Oct 18, 2026
CISA due date
—
Cloudanix analysis
A bug in the Linux kernel's handling of network file-sharing requests could let an attacker read small pieces of memory they are not supposed to see.
- Exploitation
- Remote Authenticated
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Information Disclosure
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Out-of-bounds memory reads in smb2_parse_contexts() and related SMB2/SMB3 lease/QFid handlers allow access to bytes beyond the current create-context record or at incorrect DataOffset locations when processing malformed context chains.
Why it matters to the business
Attackers may obtain fragments of unrelated kernel memory containing sensitive file metadata or other in-bounds data, increasing the risk of information leakage on systems that mount remote SMB shares.
How an attack unfolds
An attacker establishes an SMB session and issues a crafted SMB2 CREATE request containing chained create contexts with manipulated Next offsets, DataOffset values, or zero DataLength fields; the vulnerable parsers then read past intended boundaries or from incorrect positions, returning extra bytes in the response.
How to fix it
Apply the upstream Linux kernel patch that enforces Next-field limits on each context, rejects invalid offsets, requires DataLength to match lease context sizes, and bounds all name and data accesses to the current context before dispatching handlers.
How to confirm the fix worked
Confirm the fix is present by inspecting the smb2_parse_contexts() implementation for Next-field validation, DataOffset-based lease parsing, and DataLength checks; test with malformed context chains to verify no out-of-bounds reads occur.
Typical attack path
- Connect to a target SMB server over TCP 445
- Negotiate SMB2/SMB3 dialect and authenticate
- Send CREATE request with malformed context chain (invalid Next, non-canonical DataOffset, or short DataLength)
- Receive response containing leaked bytes from adjacent memory or incorrect offsets
- Repeat or refine to gather additional kernel data
How to detect it
Inspect SMB client logs and network captures for CREATE responses whose length or content exceeds expectations for the requested context; correlate with kernel oops or warning messages referencing context parsing.
What your security team should do
- Prioritize kernel updates on all systems acting as SMB clients within the next patching cycle
- Monitor EPSS and exploit maturity indicators for any rise in activity
- Restrict SMB client connections to trusted servers where possible
- Review logs for unusual CREATE responses or failed open operations that may indicate probing
The record
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes beyond the current context to a handler. The QFid handler also used a full response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same layout assumption: they read LeaseState and LeaseFlags at canonical offsets rather than at DataOffset. A valid non-canonical DataOffset could therefore yield unrelated in-bounds data, while a short DataLength was still accepted. Limit each context to its Next value, reject offsets before the context header, and reject malformed chains. Bound the name range by the current context and do not dispatch a known handler when DataLength is zero. Read the QFid DiskFileId only when the context data covers that field. Parse the lease context from DataOffset and require DataLength to match the v1 or v2 lease_context size used by ksmbd. A size mismatch skips lease parsing without failing the open.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|