Improper Handling of Length Parameter Inconsistency in Linux kernel - CVE-2026-98171

Vulnerability details

The vulnerability allows a remote attacker to cause command offsets to reference stale ciphertext residue.

The vulnerability exists due to incorrect plaintext length tracking in the SMB client's receive_encrypted_standard() function when validating command offsets in compound encrypted frames. A remote attacker can supply a frame with a NextCommand offset beyond the decrypted plaintext size but within the pre-decryption length to cause command offsets to reference stale ciphertext residue.

Affected software

How to mitigate CVE-2026-98171

External References

• https://git.kernel.org/stable/c/05762c5bc1cfdcac36747994fde2c04387a457f1
• https://git.kernel.org/stable/c/491e33144dee872cffda207f6fcb09260728f803
• https://git.kernel.org/stable/c/72eaef1f37a3b6bec11c342736834dc3707be3e4
• https://git.kernel.org/stable/c/858d5ac22cb889266993e7670f9f0c4f4aeedd78
• https://git.kernel.org/stable/c/8749946579708ea0d339034bb7f423a67dbe89cf
• https://git.kernel.org/stable/c/96c436e4b010711452b2872558938f4ef276492a

Related Security Bulletins

• Improper Handling of Length Parameter Inconsistency in Linux kernel smb client
• Debian update for linux