EUVD-2026-76542
GHSA-gch3-h386-3492
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Client-side flaw requiring a malicious or MITM SMB server (AC:H); OOB read yields limited disclosure (C:L) and likely crash (A:H); no integrity impact and no scope change.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: restore the data_offset bound in is_valid_oplock_break()
Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") changed the quantity this bound is measured against. It used to be srv->total_read minus the 4-byte RFC1002 preamble that total_read then included, so it was the SMB message length. The same commit stopped counting the preamble, and the mechanical substitution to srv->total_read - srv->pdu_size left an expression that is identically zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly pdu_length - MID_HEADER_SIZE() more, adding both to total_read.
len is therefore 0, the subtraction below it wraps, and no __u32 DataOffset can exceed the result, so the check from commit 097f5863b1a0 ("cifs: read overflow in is_valid_oplock_break()") no longer rejects anything. Use total_read, which is now the message length on its own.
AnalysisAI
Out-of-bounds read in the Linux kernel's SMB/CIFS client allows a malicious or compromised SMB server to trigger memory over-reads while the client processes oplock-break responses. A refactor (commit 83bfbd0bb902 removing the RFC1002 header from smb_hdr) mechanically rewrote a DataOffset bounds check in is_valid_oplock_break() into an expression that is identically zero, silently disabling the guard that commit 097f5863b1a0 originally added - so an attacker-supplied 32-bit DataOffset again escapes validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Linux victim to have an active SMB/CIFS mount to a server the attacker controls or can machine-in-the-middle, and the attacker must send a malicious oplock-break message with an out-of-range DataOffset field - it is not exploitable against a client that never connects to a hostile server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H) overstates practical risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Linux 7.2.4 or 7.3-rc1 (or a distribution kernel that backports fix commits 5b16a1967a01 / ba22f575de9d), which restore the DataOffset bound to use srv->total_read. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems and appliances using SMB/CIFS in your environment, including file servers, NAS devices, Kubernetes infrastructure, and virtualization hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today