CVE-2026-98170

A flaw was found in the Linux kernel's SMB client. When processing extended file attributes returned by a server, insufficient buffer validation allows the kernel to read data past the allocated boundaries. A malicious or compromised server could exploit this issue by returning a malformed response, potentially causing a system crash resulting in a Denial of Service (DoS) or disclosing sensitive kernel memory.

A moderate impact out-of-bounds read flaw was found in the Linux kernel SMB client, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and the Red Hat Enterprise Linux CoreOS-based components shipped with OpenShift Container Platform 4. When the SMB client processes extended file attributes returned by a server (for example via getxattr or listxattr), the loop in move_smb2_ea_to_cifs() does not verify that the remaining buffer is large enough to contain a complete smb2_ea_info structure, so reads of the ea_name_length and ea_value_length fields, or of entries reached via an invalid next_entry_offset, can go past the allocated buffer. A malicious or compromised SMB server could return such a malformed response to crash the client kernel (denial of service) or potentially disclose sensitive kernel memory. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are marked not affected because the vulnerable code is not present in those streams. The fix for affected products is currently deferred in line with the moderate severity assessment; exploitation requires a client to connect to an attacker-controlled or compromised SMB server and request extended attributes from it, so the residual risk is limited primarily to kernel crashes or limited information disclosure on systems that mount untrusted SMB shares. Red Hat rates this flaw Moderate with CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (score 5.5), which is lower than the network-vector severity suggested by some automated upstream scoring, because triggering the issue depends on a local client accessing an untrusted SMB server rather than on an unauthenticated remote attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.