CVE-2026-99109

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject SetEA requests that do not fit the request buffer

CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source but was never implemented:

/*BB add length check to see if it would fit in
   negotiated SMB buffer size BB */
/* if (ea value len > buffer size - 512 (enough for header)) */
if (ea value len)
	memcpy(parm data->list.name + name len + 1,
	    ea value, ea value len);

The only bound applied on the way in is in cifs xattr set():

#define MAX EA VALUE SIZE CIFSMaxBufSize
...
if (size > MAX EA VALUE SIZE)

CIFSMaxBufSize is the full payload capacity of the buffer, so a value of exactly that size leaves no room for the SMB header, the TRANS2 parameter block, the fealist header and the EA name that are written ahead of it in the same object.

SendReceive() already enforces the correct limit on this very length:

if (in len > CIFSMaxBufSize + MAX CIFS HDR SIZE)

but it is called after the copy has taken place. An unprivileged setxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte value writes 16384 bytes starting 345 bytes into a 16588-byte cifs request object, ending 141 bytes past it:

BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0 Write of size 16384 at addr ffff888003aa0159 by task init/68 asan memcpy+0x3c/0x60 CIFSSMBSetEA+0xabc/0xde0 cifs xattr set+0xd3a/0xff0 vfs setxattr+0x13e/0x1a0 The buggy address is located 345 bytes inside of allocated 16588-byte region

Apply SendReceive()'s limit to the assembled request before the copy rather than after it, and widen the byte counters so the sum cannot wrap before it is tested.

byte count is also tested against U16 MAX, because it is stored in the 16-bit pSMB->ByteCount. That becomes reachable when CIFSMaxBufSize is raised at module load, where it may be set as high as 1024*127: with a 5-byte EA name and a 65521-byte value, count is exactly U16 MAX while byte count is 65556, and cpu to le16() would truncate it to 20 and transmit a frame whose ByteCount does not match its length. Testing byte count covers count as well, since byte count is the larger of the two and count's only 16-bit consumer is written after this point.

check add overflow() is evaluated first so that total len is assigned before it is reported.