Linux Kernel
CVE-2024-26828
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Client must connect to an attacker-controlled SMB server (AC:H, UI:R); out-of-bounds read yields a limited info leak (C:L) and kernel crash (A:H), with no integrity impact.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix underflow in parse_server_interfaces()
In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending.
AnalysisAI
Memory-safety flaw in the Linux kernel's in-kernel CIFS/SMB client (parse_server_interfaces()) lets a malicious or compromised SMB server trigger an out-of-bounds buffer read on a connecting client. A signed/unsigned type-promotion bug causes a negative bytes-left counter to be treated as a large unsigned value, so the parsing loop runs past the end of the server-interface response buffer, enabling kernel memory disclosure and/or a crash. Affects 6.8 release-candidate kernels (rc1-rc4) and the CIFS code backported to stable trees; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.41%, 33rd percentile).
Technical ContextAI
The vulnerability is in fs/smb/client (formerly fs/cifs), the kernel's native SMB3/CIFS network filesystem client. When a client queries a server for its network interfaces (FSCTL_QUERY_NETWORK_INTERFACE_INFO, used for SMB multichannel), parse_server_interfaces() walks the returned buffer item-by-item, decrementing a 'bytes_left' counter of signed type ssize_t. The loop-continuation check compares bytes_left against sizeof(...), which is unsigned size_t. Per C integer-promotion rules the signed value is converted to unsigned, so once bytes_left goes negative it appears as a huge positive number and the loop keeps parsing instead of terminating - a classic CWE-191 integer underflow leading to an out-of-bounds read of adjacent kernel memory. The CPE data pins the introduction to the 6.8 development cycle (6.8-rc1 through 6.8-rc4), and the same client code was backported into multiple stable series.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor/distribution kernel update that incorporates the cifs underflow fix, referenced by the stable commits https://git.kernel.org/stable/c/7190353835b4a219abb70f90b06cdcae97f11512, https://git.kernel.org/stable/c/cffe487026be13eaf37ea28b783d9638ab147204, https://git.kernel.org/stable/c/df2af9fdbc4ddde18a3371c4ca1a86596e8be301 and https://git.kernel.org/stable/c/f7ff1c89fb6e9610d2b01c1821727729e6609308, or the equivalent errata kernel from your distribution (rebuild/reboot required to load the corrected cifs.ko). Until patched, compensating controls: only mount SMB/CIFS shares from trusted, authenticated servers and avoid mounting from untrusted or internet-reachable hosts (trade-off: minimal in well-run environments, but blocks ad-hoc mounts); where CIFS is not required, blacklist/unload the cifs kernel module (modprobe blacklist) to remove the attack surface entirely (trade-off: breaks all SMB share access); and restrict outbound SMB egress (TCP 445/139) at the firewall so clients cannot be steered to rogue servers on hostile networks (trade-off: may block legitimate remote SMB use). Disabling SMB multichannel where configurable reduces reliance on the interface-query path but is version-dependent and not a guaranteed mitigation.
Same weakness CWE-191 – Integer Underflow
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today