CVE-2026-98170 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds.
Fix this by ensuring src_size >= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer.
Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating "attribute not present" or "output buffer too small".
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The Linux kernel SMB client implementation contains a critical out-of-bounds read vulnerability within the move_smb2_ea_to_cifs function, which is responsible for translating Extended Attribute structures from the SMB 2 protocol format to the CIFS internal representation. This flaw stems from an insufficient loop condition in the parsing logic that processes attribute lists returned by remote servers. Specifically, the while loop continues iterating as long as src_size remains greater than zero, without verifying whether the remaining buffer contains enough data to hold a complete smb2_ea_info structure. Consequently, when processing malformed or truncated EA lists sent by an untrusted server, the kernel may attempt to read fields such as ea_name_length and ea_value_length from memory locations beyond the allocated buffer boundaries. This constitutes a classic out-of-bounds read vulnerability that can lead to information disclosure of sensitive kernel memory contents or cause a denial of service through a kernel panic if the accessed memory is unmapped or protected.
From a technical perspective, this issue aligns with CWE-125 Out-of-Bounds Read and represents a failure in input validation during protocol parsing. The vulnerability allows an attacker controlling the SMB server to craft malicious responses that trigger these invalid reads when a client attempts to retrieve or list extended attributes on files hosted by that server. While typically classified as a read-only flaw, out-of-bounds memory access can sometimes be leveraged for further exploitation depending on adjacent memory layout and kernel hardening features like KASLR or stack canaries. The ATT&CK framework categorizes this behavior under T1005 Data from Local System Retrieval if the leaked data includes sensitive information, although in many cases it primarily results in service disruption via kernel oops or panic due to invalid memory access violations enforced by modern operating systems.
The operational impact of this vulnerability is significant for organizations relying on Linux-based SMB clients for file sharing and network storage integration. Successful exploitation could allow a malicious server operator to crash the client system, leading to availability issues across connected workstations or servers. In more severe scenarios where adjacent memory structures are accessible, there may be potential for information leakage regarding kernel pointers, cryptographic keys, or other sensitive data stored in nearby allocations. The fix addresses this by enforcing strict bounds checking before any field access occurs within the loop. It ensures that src_size is at least equal to the size of a single smb2_ea_info structure before attempting to parse its fields. Additionally, the patch validates next_entry_offset values to prevent pointer arithmetic from advancing beyond the available buffer limits, thereby closing both the immediate read vulnerability and potential integer overflow or wrap-around issues associated with offset calculations.
Furthermore, this update improves protocol error handling semantics by changing the return codes for malformed EA lists. Previously, such errors might have been reported as -ENODATA indicating no data was found or -ERANGE suggesting an output buffer size mismatch, which could mislead applications into thinking the issue lay with local configuration rather than server-side malformation. The corrected behavior now returns -EIO to explicitly signal a low-level input/output error consistent with protocol violations detected during parsing. This change aids in accurate diagnostics and troubleshooting for system administrators and developers monitoring SMB client interactions. Mitigation strategies include applying the latest kernel patches that contain this fix, ensuring all Linux systems acting as SMB clients are updated promptly. Network segmentation policies should also be enforced to restrict direct access from untrusted or public-facing servers to internal file sharing infrastructure, reducing the attack surface available for crafting malicious protocol responses. Regular auditing of network traffic and monitoring for unusual SMB client behavior can provide additional layers of defense against exploitation attempts targeting this class of parsing vulnerabilities.