CVE-2026-72310 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix overflow in passthrough ioctl bounds check
smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace.
The payload offset and length both come from 32-bit fields. The bounds check currently adds OutputOffset and qi.input_buffer_length directly, so the addition can wrap in 32-bit arithmetic before the result is compared against the response buffer length.
A malicious server can use a large OutputOffset and a small OutputCount to make the wrapped sum pass the bounds check. The later copy_to_user() then reads from io_rsp + OutputOffset, outside the response buffer.
Use size_add() for the offset plus length check so overflow is treated as out of bounds.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's SMB client implementation where a buffer overflow condition can occur during passthrough ioctl operations. The flaw specifically affects the smb2_ioctl_query_info() function which handles filesystem control operations through the SMB protocol. The issue stems from improper validation of response payload boundaries when processing PASSTHRU_FSCTL operations that are essential for maintaining compatibility with Windows file systems and their extended attributes. The vulnerability represents a classic case of integer overflow in bounds checking logic that can lead to arbitrary code execution or system compromise.
The technical root cause involves 32-bit arithmetic overflow during the validation process where both OutputOffset and qi.input_buffer_length values are treated as 32-bit fields. When these values are added together directly without proper overflow detection, the sum can wrap around due to 32-bit limitations before being compared against the actual response buffer length. This mathematical flaw allows an attacker to craft malicious responses from a compromised server where the OutputOffset parameter is set to a large value while keeping OutputCount small enough to make the wrapped arithmetic result appear valid during bounds checking. The vulnerability falls under CWE-191 Integer Underflow/Overflow, specifically demonstrating how improper integer handling can lead to memory safety issues.
The operational impact of this vulnerability is significant as it enables remote code execution against systems running vulnerable Linux kernels when they connect to malicious SMB servers. An attacker controlling the SMB server can manipulate the response buffer to bypass the bounds check and cause out-of-bounds memory reads during copy_to_user() operations. This creates a potential privilege escalation vector that could allow attackers to execute arbitrary code with kernel privileges, effectively compromising the entire system. The vulnerability affects systems using the SMB client implementation for file sharing operations, particularly those connecting to Windows servers or other SMB implementations that may be compromised.
The fix implemented addresses this issue by replacing direct arithmetic addition with size_add() function calls that properly handle integer overflow conditions by treating overflow scenarios as out-of-bounds errors. This approach aligns with defensive programming practices recommended in the Linux kernel security guidelines and follows ATT&CK technique T1059.007 for execution through system binaries. Organizations should prioritize patching this vulnerability immediately, especially in environments where SMB connectivity is required and where the risk of connecting to untrusted servers cannot be eliminated. The mitigation strategy also includes implementing network segmentation and monitoring for suspicious SMB traffic patterns that might indicate exploitation attempts.
This vulnerability demonstrates the critical importance of proper integer overflow handling in kernel space operations and highlights how seemingly minor flaws in bounds checking can lead to severe security consequences. The fix represents a standard approach for preventing such issues by using kernel-provided safe arithmetic functions that are designed to detect and handle overflow conditions appropriately. Security teams should monitor for similar patterns in other kernel subsystems and ensure that all integer arithmetic operations involving buffer sizes and offsets follow secure coding practices to prevent analogous vulnerabilities from being introduced in future code modifications.