EUVD-2026-76543
GHSA-95qf-fgcq-pcrc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Network-delivered by a malicious SMB server the victim must connect to (UI:R), no client auth (PR:N); primary impact is kernel-memory disclosure (C:H) with a possible crash (A:L), no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject a tree connect response whose byte count is too small
CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData.
Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.
AnalysisAI
Kernel-memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) lets a malicious or compromised SMB server leak up to ~65535 bytes of adjacent slab memory to userspace. CIFSTCon() computes its string-parsing bound from the server-supplied ByteCount minus two; a ByteCount of 0 or 1 underflows to a negative int that converts to a huge size_t and wraps the __u16 bytes_left, so cifs_strndup_from_utf16() reads far past the ~16 KB cifs_req_poolp slab object, and the leaked bytes surface via tcon->nativeFileSystem in /proc/fs/cifs/DebugData. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Linux client to establish an SMB1/CIFS tree connect to an attacker-controlled or compromised SMB server (or a MITM position on the connection); the malicious server returns a TCON response with ByteCount of 0 or 1 to trigger the integer underflow. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/A:H) overstates real-world exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 6.18.51, 7.2.4, or 7.3-rc1 (or the corresponding distribution kernel that backports commits 3be89e80…, 411e484f…, or 65deb183…). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all Linux systems with active SMB/CIFS client functionality by checking for mounted CIFS shares (mount | grep cifs) and loaded cifs.ko module; disable non-essential SMB connections or restrict them to trusted internal servers only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today