PT-2026-106500 · Linux · Linux

CVE-2026-98171

Published

2026-10-06

Updated

2026-10-06

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix next buffer UAF and NextCommand bounds in compound PDUs

Fix several related bounds checking and pointer lifecycle issues in receive encrypted standard()'s handling of compound encrypted frames:

Clear next buffer after assigning it to server->bigbuf. A stale next buffer pointer can lead to a use-after-free on subsequent error paths.
Update pdu length to the decrypted plaintext size (buf size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue.
Reject next cmd values smaller than MID HEADER SIZE(server).
Fix an integer overflow in the upper bound check by verifying pdu length - next cmd < MID HEADER SIZE(server), ensuring the trailing slice is large enough for a header.

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-98171

Linux