CVE-2026-43185

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A signedness bug exists in the smb direct prepare negotiation() function. The function casts unsigned u32 values from sp->max recv size and req->preferred send size to signed integers before computing the minimum value. An attacker can provide a preferred send size of 0x80000000, which is interpreted as smaller than max recv size and used to set the maximum allowed receive size for the subsequent message. By sending a second message exceeding 1420 bytes, a heap buffer overflow can be achieved.