PT-2026-115749
Published
2026-10-06
·
Updated
2026-10-06
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix next buffer UAF and NextCommand bounds in compound PDUs
Fix several related bounds checking and pointer lifecycle issues in
receive encrypted standard()'s handling of compound encrypted frames:
- Clear next buffer after assigning it to server->bigbuf. A stale next buffer pointer can lead to a use-after-free on subsequent error paths.
- Update pdu length to the decrypted plaintext size (buf size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue.
- Reject next cmd values smaller than MID HEADER SIZE(server).
- Fix an integer overflow in the upper bound check by verifying pdu length - next cmd < MID HEADER SIZE(server), ensuring the trailing slice is large enough for a header.
Vendors
Affected products
Related identifiers
Found an issue in the description? Have something to add? Feel free to write us 👾