PT-2026-106500 · Linux · Linux

CVE-2026-98171

Publicado

2026-10-06

Atualizado

2026-10-06

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix next buffer UAF and NextCommand bounds in compound PDUs

Fix several related bounds checking and pointer lifecycle issues in receive encrypted standard()'s handling of compound encrypted frames:

Clear next buffer after assigning it to server->bigbuf. A stale next buffer pointer can lead to a use-after-free on subsequent error paths.
Update pdu length to the decrypted plaintext size (buf size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue.
Reject next cmd values smaller than MID HEADER SIZE(server).
Fix an integer overflow in the upper bound check by verifying pdu length - next cmd < MID HEADER SIZE(server), ensuring the trailing slice is large enough for a header.

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

CVE-2026-98171

Linux