Improper Validation of Specified Index, Position, or Offset in Input in Linux kernel - CVE-2026-98171
Published: October 7, 2026
Vulnerability identifier: #VU153852
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98171
CWE-ID: CWE-1285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause acceptance of command offsets below the minimum header size.
The vulnerability exists due to insufficient command offset validation in the SMB client's receive_encrypted_standard() function when handling compound encrypted frames. A remote attacker can supply a frame with a nonzero NextCommand value smaller than MID_HEADER_SIZE(server) to cause acceptance of command offsets below the minimum header size.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98171
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/05762c5bc1cfdcac36747994fde2c04387a457f1
- https://git.kernel.org/stable/c/491e33144dee872cffda207f6fcb09260728f803
- https://git.kernel.org/stable/c/72eaef1f37a3b6bec11c342736834dc3707be3e4
- https://git.kernel.org/stable/c/858d5ac22cb889266993e7670f9f0c4f4aeedd78
- https://git.kernel.org/stable/c/8749946579708ea0d339034bb7f423a67dbe89cf
- https://git.kernel.org/stable/c/96c436e4b010711452b2872558938f4ef276492a