{"api_version":"1","generated_at":"2026-10-26T07:00:55+00:00","cve":"CVE-2026-98454","urls":{"html":"https://cve.report/CVE-2026-98454","api":"https://cve.report/api/cve/CVE-2026-98454.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98454","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98454"},"summary":{"title":"smb: client: fix create context out-of-bounds reads","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it.  A\nmalformed chain can therefore expose bytes beyond the current context to\na handler.  The QFid handler also used a full response-structure cast\nalthough it only reads DiskFileId.\n\nThe SMB2/SMB3 lease parsers made the same layout assumption: they read\nLeaseState and LeaseFlags at canonical offsets rather than at\nDataOffset.  A valid non-canonical DataOffset could therefore yield\nunrelated in-bounds data, while a short DataLength was still accepted.\n\nLimit each context to its Next value, reject offsets before the context\nheader, and reject malformed chains.  Bound the name range by the current\ncontext and do not dispatch a known handler when DataLength is zero.  Read\nthe QFid DiskFileId only when the context data covers that field.  Parse the\nlease context from DataOffset and require DataLength to match the v1 or v2\nlease_context size used by ksmbd.  A size mismatch skips lease parsing\nwithout failing the open.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:16:55","updated_at":"2026-10-24 14:16:42"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","data":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/cecc5399987e73a528ce2b662eeb54af69163cbd","name":"https://git.kernel.org/stable/c/cecc5399987e73a528ce2b662eeb54af69163cbd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/67f4c1c6a1b51e203d986779299824d1c2c590a6","name":"https://git.kernel.org/stable/c/67f4c1c6a1b51e203d986779299824d1c2c590a6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/05a7fd80024ff32b9b40ab1478bb172eeab1c386","name":"https://git.kernel.org/stable/c/05a7fd80024ff32b9b40ab1478bb172eeab1c386","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e4c49012708c917eafd9c27054b02d0f8b30fe64","name":"https://git.kernel.org/stable/c/e4c49012708c917eafd9c27054b02d0f8b30fe64","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/28bc9a871799363afa3139e961a8e3684feb8704","name":"https://git.kernel.org/stable/c/28bc9a871799363afa3139e961a8e3684feb8704","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98454","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98454","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b8c32dbb0deb287a5fcb78251e4eae6c7275760d e4c49012708c917eafd9c27054b02d0f8b30fe64 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b8c32dbb0deb287a5fcb78251e4eae6c7275760d 28bc9a871799363afa3139e961a8e3684feb8704 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b8c32dbb0deb287a5fcb78251e4eae6c7275760d 05a7fd80024ff32b9b40ab1478bb172eeab1c386 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b8c32dbb0deb287a5fcb78251e4eae6c7275760d cecc5399987e73a528ce2b662eeb54af69163cbd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b8c32dbb0deb287a5fcb78251e4eae6c7275760d 67f4c1c6a1b51e203d986779299824d1c2c590a6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.158 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.112 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.55 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.9 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c","fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e4c49012708c917eafd9c27054b02d0f8b30fe64","status":"affected","version":"b8c32dbb0deb287a5fcb78251e4eae6c7275760d","versionType":"git"},{"lessThan":"28bc9a871799363afa3139e961a8e3684feb8704","status":"affected","version":"b8c32dbb0deb287a5fcb78251e4eae6c7275760d","versionType":"git"},{"lessThan":"05a7fd80024ff32b9b40ab1478bb172eeab1c386","status":"affected","version":"b8c32dbb0deb287a5fcb78251e4eae6c7275760d","versionType":"git"},{"lessThan":"cecc5399987e73a528ce2b662eeb54af69163cbd","status":"affected","version":"b8c32dbb0deb287a5fcb78251e4eae6c7275760d","versionType":"git"},{"lessThan":"67f4c1c6a1b51e203d986779299824d1c2c590a6","status":"affected","version":"b8c32dbb0deb287a5fcb78251e4eae6c7275760d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2ops.c","fs/smb/client/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.7"},{"lessThan":"3.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.158","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.112","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.55","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.158","versionStartIncluding":"3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.112","versionStartIncluding":"3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.55","versionStartIncluding":"3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.9","versionStartIncluding":"3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"3.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it.  A\nmalformed chain can therefore expose bytes beyond the current context to\na handler.  The QFid handler also used a full response-structure cast\nalthough it only reads DiskFileId.\n\nThe SMB2/SMB3 lease parsers made the same layout assumption: they read\nLeaseState and LeaseFlags at canonical offsets rather than at\nDataOffset.  A valid non-canonical DataOffset could therefore yield\nunrelated in-bounds data, while a short DataLength was still accepted.\n\nLimit each context to its Next value, reject offsets before the context\nheader, and reject malformed chains.  Bound the name range by the current\ncontext and do not dispatch a known handler when DataLength is zero.  Read\nthe QFid DiskFileId only when the context data covers that field.  Parse the\nlease context from DataOffset and require DataLength to match the v1 or v2\nlease_context size used by ksmbd.  A size mismatch skips lease parsing\nwithout failing the open."}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - A malicious SMB server supplies the malformed RqLs or QFid chain in an SMB2 CREATE Response over TCP/445; cifs_demultiplex_thread() receives it and cifs_send_recv() returns it through SMB2_open() to the patched smb2_parse_contexts() and its handlers.\nAC:L - The server directly controls Next, DataOffset, DataLength, and the context name; a short final RqLs record deterministically reaches the fixed-layout lease parser without any race or condition outside the attacker's control.\nPR:N - Although SESSION_SETUP and TREE_CONNECT precede SMB2 CREATE, they authenticate the victim client to the server; an attacker operating the SMB endpoint needs no account or privilege on the client host to return the malformed response.\nUI:R - The victim must mount or connect to the attacker's share, or access a mounted path so cifs_open(), cifs_is_path_remote(), or cached-directory handling issues SMB2 CREATE; the server cannot invoke smb2_parse_contexts() unsolicited.\nS:U - The reads and resulting lease or inode state remain within the SMB client kernel's security authority; no VM, IOMMU, or other distinct security boundary is crossed.\nC:H - smb3_parse_lease_buf() can copy 16 bytes beyond a short RqLs record into fid->lease_key; cifs_do_create() can retain it through smb2_set_lease_key(), and a later add_lease_context() returns those adjacent kernel bytes to the server, repeatably exposing heap memory.\nI:N - The vulnerable lease and QFid handlers only read into designated scalar, lease-key, and IndexNumber outputs; they neither overwrite out-of-bounds kernel memory nor provide a write or control-flow primitive.\nA:H - A final RqLs record can contain only its 20-byte header and name while smb3_parse_lease_buf() reads through Epoch at canonical offset 72; placing that record at the response-buffer tail makes the fixed-width loads cross the allocation and can produce a repeatable kernel fault or oops."}]}],"providerMetadata":{"dateUpdated":"2026-10-24T14:08:54.144Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e4c49012708c917eafd9c27054b02d0f8b30fe64"},{"url":"https://git.kernel.org/stable/c/28bc9a871799363afa3139e961a8e3684feb8704"},{"url":"https://git.kernel.org/stable/c/05a7fd80024ff32b9b40ab1478bb172eeab1c386"},{"url":"https://git.kernel.org/stable/c/cecc5399987e73a528ce2b662eeb54af69163cbd"},{"url":"https://git.kernel.org/stable/c/67f4c1c6a1b51e203d986779299824d1c2c590a6"}],"title":"smb: client: fix create context out-of-bounds reads","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98454","datePublished":"2026-10-18T15:15:04.139Z","dateReserved":"2026-09-25T10:25:14.350Z","dateUpdated":"2026-10-24T14:08:54.144Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:16:55","lastModifiedDate":"2026-10-24 14:16:42","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98454","Ordinal":"1","Title":"smb: client: fix create context out-of-bounds reads","CVE":"CVE-2026-98454","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98454","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix create context out-of-bounds reads\n\nsmb2_parse_contexts() validates the complete create-context area but\ndoes not limit each record to its Next field before dispatching it.  A\nmalformed chain can therefore expose bytes beyond the current context to\na handler.  The QFid handler also used a full response-structure cast\nalthough it only reads DiskFileId.\n\nThe SMB2/SMB3 lease parsers made the same layout assumption: they read\nLeaseState and LeaseFlags at canonical offsets rather than at\nDataOffset.  A valid non-canonical DataOffset could therefore yield\nunrelated in-bounds data, while a short DataLength was still accepted.\n\nLimit each context to its Next value, reject offsets before the context\nheader, and reject malformed chains.  Bound the name range by the current\ncontext and do not dispatch a known handler when DataLength is zero.  Read\nthe QFid DiskFileId only when the context data covers that field.  Parse the\nlease context from DataOffset and require DataLength to match the v1 or v2\nlease_context size used by ksmbd.  A size mismatch skips lease parsing\nwithout failing the open.","Type":"Description","Title":"smb: client: fix create context out-of-bounds reads"}]}}}