Out-of-bounds read in Linux kernel - CVE-2026-98169

Vulnerability details

The vulnerability allows a remote attacker to disclose kernel memory to userspace.

The vulnerability exists due to an out-of-bounds read in smb3_enum_snapshots() in the Linux kernel SMB client when processing short server replies during snapshot enumeration. A remote attacker can supply a specially crafted SMB ioctl reply to disclose kernel memory to userspace.

The vulnerable path is reached when snapshot_array_size is smaller than GMT_TOKEN_SIZE. The exposed data comes from slab memory adjacent to the reply buffer.

Affected software

How to mitigate CVE-2026-98169

External References

• https://git.kernel.org/stable/c/15a221c734b9d044ab769e7e3606b2cab96fb65a
• https://git.kernel.org/stable/c/1cdf0d304d820fb13bf0faf532c3459600f9ea43
• https://git.kernel.org/stable/c/210f0f1f67817e7d2348b86b5115a9b85ef5c98b
• https://git.kernel.org/stable/c/4775c3b7a597907e0b97556c7986fda238a377ae
• https://git.kernel.org/stable/c/74995ee8305a7c4d76ee70d6acd996a75eda3c03
• https://git.kernel.org/stable/c/dbe452a905dfe2804647530a9ff3d7e3826ed04d

Related Security Bulletins

• Out-of-bounds read in Linux kernel smb client
• Debian update for linux