CVE-2026-97565

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the SMB client where the CIFSSMBRead() function processes READ RSP responses from a server without verifying that the full response was received. Specifically, the function reads DataLengthHigh, DataLength, and DataOffset from the response header before ensuring the response length, stored in rsp iov.iov len, is at least read rsp size. A malicious or compromised SMB1 server could send a response shorter than the header, causing the system to read past the end of the receive buffer. This condition is only reachable when an explicit vers=1.0 mount is used, as SMB1 is not negotiated by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.