Use-after-free in Linux kernel - CVE-2026-98171

Vulnerability details

The vulnerability allows a remote attacker to trigger access to freed memory.

The vulnerability exists due to use-after-free in the SMB client's receive_encrypted_standard() function when handling compound encrypted frames and subsequent error paths. A remote attacker can supply compound encrypted frames that encounter an error after buffer reassignment to trigger access to freed memory.

The next_buffer pointer remains stale after its buffer is assigned to server->bigbuf.

Affected software

How to mitigate CVE-2026-98171

External References

• https://git.kernel.org/stable/c/05762c5bc1cfdcac36747994fde2c04387a457f1
• https://git.kernel.org/stable/c/491e33144dee872cffda207f6fcb09260728f803
• https://git.kernel.org/stable/c/72eaef1f37a3b6bec11c342736834dc3707be3e4
• https://git.kernel.org/stable/c/858d5ac22cb889266993e7670f9f0c4f4aeedd78
• https://git.kernel.org/stable/c/8749946579708ea0d339034bb7f423a67dbe89cf
• https://git.kernel.org/stable/c/96c436e4b010711452b2872558938f4ef276492a

Related Security Bulletins

• Use-after-free in Linux kernel smb client
• Debian update for linux