CVE-2026-98405

A flaw was found in the Linux kernel's SMB (Server Message Block) client. When parsing POSIX security identifiers in server responses, the client fails to properly validate the server-supplied buffer length against the actual received message boundaries. A malicious or compromised SMB server could exploit this flaw by returning an inflated length value, triggering an out-of-bounds read into adjacent kernel memory. This issue may lead to information disclosure or a denial of service (DoS) caused by a system crash.

The SMB client parse_posix_sids path calculates sidsbuf_end from the server supplied out_len without first validating it against the actual received iov length. A malicious or compromised SMB server can provide an inflated length and make posix_info_sid_size read beyond the response buffer into adjacent kernel memory. This may cause a kernel crash or invalid SID parsing and therefore represents a remotely triggerable availability risk for clients connected to an attacker controlled server. For the CVSS the PR:N value is used because the attacker does not need credentials or local privileges on the affected client and only needs control of the SMB server response. AV:N is used because the malformed response can be delivered over a routed SMB connection. The base impact is denial of service because no direct return path for the out of bounds kernel data is demonstrated. The issue does not justify CIA:HHH because the available primitive is an out of bounds read rather than an arbitrary write or a demonstrated use after free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.