Heap-based buffer overflow in Linux kernel - CVE-2026-43185

Vulnerability identifier: #VU130545

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-43185

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in smb_direct_prepare_negotiation() when processing crafted SMB Direct negotiation messages. A remote attacker can send a crafted preferred_send_size value followed by a large second message to execute arbitrary code.

The issue is triggered by a signedness error that causes a malicious preferred_send_size value of 0x80000000 to be treated as smaller than max_recv_size and used to set the allowed receive size for the next message.

Linux kernel
Ubuntu
linux-gcp-5.15 (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-hwe-6.8 (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-azure-fde-6.8 (Ubuntu package)
linux-azure (Ubuntu package)
linux-hwe-6.17 (Ubuntu package)
linux-azure-fde-6.17 (Ubuntu package)
linux-raspi (Ubuntu package)
linux-azure-6.17 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-gcp-5.15 (Ubuntu package) - addressed in versions 5.15.0-1106.112~20.04.1, 5.15.0-1111.121~20.04.1
linux-azure-fips (Ubuntu package) - addressed in versions 5.15.0.1116.101, 5.15.0-1116.125+fips1
linux-hwe-6.8 (Ubuntu package) - update to 6.8.0-136.136~22.04.1
linux-azure-fde (Ubuntu package) - update to 6.8.0-1062.69
linux-azure-fde-6.8 (Ubuntu package) - update to 6.8.0-1062.69~22.04.1
linux-azure (Ubuntu package) - addressed in versions 6.8.0-1063.71, 6.8.0-1063.71~22.04.1
linux-hwe-6.17 (Ubuntu package) - update to 6.17.0-40.40~24.04.1
linux-azure-fde-6.17 (Ubuntu package) - update to 6.17.0-1018.18~24.04.1
linux-raspi (Ubuntu package) - update to 6.17.0-1021.21
linux-azure-6.17 (Ubuntu package) - update to 6.17.0-1021.21~24.04.1

• https://git.kernel.org/stable/c/55abc475d096da4a5356b6efb0cfdc6156bc1550
• https://git.kernel.org/stable/c/6b4f875aac344cdd52a1f34cc70ed2f874a65757
• https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b

• Heap-based buffer overflow in Linux kernel smb server
• Ubuntu update for linux-hwe-6.17
• Ubuntu update for linux-raspi
• Ubuntu update for linux-gcp-5.15
• Ubuntu update for linux-azure-fde-6.8
• Ubuntu update for linux-azure-fde
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-fde-6.17
• Ubuntu update for linux-azure-6.17
• Ubuntu update for linux-azure-fips
• Ubuntu update for linux-hwe-6.8