CVE-2026-98405 json
smb: client: fix missing iov bounds check in parse_posix_sids()
published 28d ago modified 18d ago also EUVD-2026-101054
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missing iov bounds check in parse_posix_sids()
In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len).
If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory.
Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.
Patch / fix
- Linux Linux 6.6.158, 7.3
- kernel-source openSUSE Tumbleweed 7.2.11-1.1
opensuse advisories openSUSE-SU-2026:12165-1
- git.kernel.org/stable/c/d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644 commit
- git.kernel.org/stable/c/b862996e5105be1293da9cdc85da77b76021c3bd commit
- git.kernel.org/stable/c/2f8ed71aaaba3bc8b19cd9930cc62e63e142b299 commit
- git.kernel.org/stable/c/eac6917a42899aad0617bbf04798c5dd946a1fe5 commit
- git.kernel.org/stable/c/b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc commit
Is CVE-2026-98405 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-98405 updated cvss 7.1
kernel: smb: client: fix missing iov bounds check in parse_posix_sids()
-
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9affected: workaround, no fix available “Fix deferred”
-
Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 morenot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
Affected products
- Linux Linux
Classification
- Technology feeds
References
- git.kernel.org /stable/c/d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644
- git.kernel.org /stable/c/b862996e5105be1293da9cdc85da77b76021c3bd
- git.kernel.org /stable/c/2f8ed71aaaba3bc8b19cd9930cc62e63e142b299
- git.kernel.org /stable/c/eac6917a42899aad0617bbf04798c5dd946a1fe5
- git.kernel.org /stable/c/b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc
Sources
- CVE List CVE-2026-98405
- NVD CVE-2026-98405
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.