Out-of-bounds read in Linux kernel - CVE-2026-98454

Vulnerability details

The vulnerability allows a remote attacker to trigger out-of-bounds memory reads that may disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds reads in the Linux kernel SMB client's create-context and lease parsers when processing malformed SMB2/SMB3 create responses. A remote attacker can supply a crafted response from an SMB server with inconsistent context boundaries, data offsets, or data lengths to cause handlers to read beyond the current context or interpret unrelated bytes as file identifiers or lease data, potentially exposing sensitive information or causing a denial of service.

Affected software

How to mitigate CVE-2026-98454

External References

• https://git.kernel.org/stable/c/05a7fd80024ff32b9b40ab1478bb172eeab1c386
• https://git.kernel.org/stable/c/28bc9a871799363afa3139e961a8e3684feb8704
• https://git.kernel.org/stable/c/67f4c1c6a1b51e203d986779299824d1c2c590a6
• https://git.kernel.org/stable/c/cecc5399987e73a528ce2b662eeb54af69163cbd
• https://git.kernel.org/stable/c/e4c49012708c917eafd9c27054b02d0f8b30fe64

Related Security Bulletins

• Out-of-bounds read in Linux kernel smb client
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more