Integer overflow in Linux kernel - CVE-2026-98171

Vulnerability details

The vulnerability allows a remote attacker to bypass command offset bounds checks.

The vulnerability exists due to integer overflow in the SMB client's receive_encrypted_standard() function when checking upper bounds for command offsets in compound encrypted frames. A remote attacker can supply a frame with a NextCommand value that triggers overflow in the upper-bound calculation to bypass command offset bounds checks.

The bounds check is intended to ensure that the trailing slice is large enough to contain a header.

Affected software

How to mitigate CVE-2026-98171

External References

• https://git.kernel.org/stable/c/05762c5bc1cfdcac36747994fde2c04387a457f1
• https://git.kernel.org/stable/c/491e33144dee872cffda207f6fcb09260728f803
• https://git.kernel.org/stable/c/72eaef1f37a3b6bec11c342736834dc3707be3e4
• https://git.kernel.org/stable/c/858d5ac22cb889266993e7670f9f0c4f4aeedd78
• https://git.kernel.org/stable/c/8749946579708ea0d339034bb7f423a67dbe89cf
• https://git.kernel.org/stable/c/96c436e4b010711452b2872558938f4ef276492a

Related Security Bulletins

• Integer overflow in Linux kernel smb client
• Debian update for linux