EUVD-2026-93099
GHSA-68gh-wq6f-89rf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure Linux client to malicious SMB server
-
DeliverySend crafted compound encrypted PDU
-
ExploitTrigger use-after-free in cifs parser
-
ExecutionCorrupt kernel memory
-
ImpactExecute code or crash in kernel context
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the victim Linux host to act as an SMB/CIFS client and connect to or mount a share from an attacker-controlled or MITM'd SMB server, and the vulnerable code path is the encrypted compound-frame handler (receive_encrypted_standard), so SMB3 encryption/sealing must be negotiated for the crafted compound PDU to reach the affected logic. The attacker must control server-side responses to supply malformed NextCommand/next_cmd offsets and lengths. Limiting factors: no authentication against the vulnerable client is needed (PR:N), but user or system interaction to establish the mount/connection is required (UI:R), the cifs.ko client module must be loaded and in use, and the host must not already be on a patched kernel; it is NOT remotely exploitable against an idle default system with no outbound SMB connection. |
| Impact | Signals point to a real but conditional priority rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw with high impact to confidentiality, integrity and availability - consistent with a kernel-memory-corruption use-after-free. However, this is a client-side bug in the Linux kernel SMB/CIFS client (receive_encrypted_standard handling of compound encrypted frames), so AV:N and PR:N must be read in context: the 'attacker' is a malicious or MITM'd SMB server, and the UI:R reflects that a victim host must mount/connect to that server for the crafted PDU to be processed. The EPSS score of 0.21% (11th percentile) is low and there is no CISA KEV listing and no identified public exploit code, indicating no evidence of active or widespread exploitation to date. Note the apparent tension between a high 8.8 CVSS and the low EPSS: this is typical of upstream Linux stable-tree memory-corruption fixes that are serious in principle but require a specific adversarial-server precondition that limits opportunistic mass exploitation. CWE is listed as N/A and the only tag is 'Buffer Overflow,' whereas the description is primarily a use-after-free plus integer-overflow bounds issue - treat the classification as approximate. |
| Exploit ScenarioDerived | A Linux host mounts an SMB share from a server controlled by the attacker (or the attacker MITMs an existing SMB session with encryption negotiated). The malicious server returns a crafted compound encrypted response whose NextCommand/next_cmd fields and lengths drive the client to reuse a stale next_buffer pointer or read past the decrypted plaintext, triggering a use-after-free in kernel context that can corrupt memory and potentially lead to kernel code execution or crash. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Use-after-free and out-of-bounds pointer handling in the Linux kernel CIFS/SMB client (cifs.ko) lets a malicious or man-in-the-middle SMB server corrupt kernel memory on a connecting client by returning crafted encrypted compound PDUs. The defect sits in receive_encrypted_standard(), where a stale next_buffer pointer retained on error paths and unvalidated NextCommand/next_cmd offsets taken from pre-decryption length can lead to use-after-free and reads beyond the reassembly buffer, affecting confidentiality, integrity and availability of the host. Exploitation requires the victim to act as an SMB client and mount or connect to an attacker-controlled share, with SMB3 encryption/sealing negotiated and attacker-controlled server responses; no public exploit has been identified at time of analysis, EPSS is low at 0.21% (11th percentile), and vendor-released patches exist for the affected stable trees.
RemediationAI
Apply the vendor-released kernel updates that contain the fix, using the exact upstream stable versions: 6.1.189, 6.6.158, 6.12.112, 6.18.54 or 7.2.8, with mainline users moving to 7.3-rc4 or later; the corresponding stable commits are linked from the advisory references and from the CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-98171), and distributions that backport should be validated against their own kernel changelog since the EUVD entry lists an affected range beginning at commit b24df3e30cbf48255db866720fb71f14bf9d2f39 spanning multiple stable branches including the Linux 4.19 series. If an immediate kernel upgrade is not possible, the most effective compensating control is to avoid reaching the vulnerable code path: do not mount or connect a CIFS/SMB share from an untrusted or unauthenticated network segment, and where SMB3 encryption/sealing is not operationally required, omit the 'seal' mount option so encrypted compound frames are never negotiated, at the trade-off of losing confidentiality protection for SMB traffic. Additional hardening with trade-offs includes filtering outbound TCP 445/139 and disabling the cifs.ko module entirely on hosts that do not use SMB (removes all SMB client functionality), pinning SMB mounts to known-good servers and requiring server-side SMB signing to reduce MITM feasibility, and monitoring for abnormal cifs reconnect/reassembly errors since repeated malformed compound frames may indicate exploitation attempts. Note that no public exploit has been identified at time of analysis, so these measures are precautionary rather than emergency responses.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SMB2/SMB3 compound PDUs chain multiple operations in a single message, with each SMB2 header carrying a NextCommand field that gives the byte offset to the next header; the kernel constants involved here include MID_HEADER_SIZE(server), which defines the minimum size of an SMB2 header. When SMB3 encryption/sealing is negotiated, encrypted frames arrive wrapped in a transform header and are decrypted and reassembled by the cifs.ko receive_encrypted_standard() path into server->bigbuf. The patch addresses four related memory-safety issues in that path: next_buffer was not cleared after being assigned to server->bigbuf, leaving a dangling pointer that a later error path could dereference as a use-after-free; pdu_length was left at the pre-decryption ciphertext length instead of being updated to the decrypted plaintext size (buf_size), which allowed NextCommand to point into stale ciphertext residue; next_cmd values smaller than MID_HEADER_SIZE(server) were not rejected; and the upper-bound check contained an integer-overflow-prone comparison that was replaced by verifying that pdu_length - next_cmd is smaller than MID_HEADER_SIZE(server), guaranteeing the trailing slice is large enough to hold a header. Although the CVE record supplies no CWE, the issues fall into the classic use-after-free (dangling pointer) and out-of-bounds/improper input validation classes for attacker-controlled length fields. The CPE entries map to the generic Linux kernel package (cpe:2.3:a:linux:linux:*), meaning all kernel builds carrying the unfixed cifs.ko code are in scope; the fixes are recorded in the stable git trees referenced by the advisory links.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable via a malicious SMB server with no client auth (PR:N) but requiring a victim-initiated connection (UI:R); reliably leveraging a kernel UAF raises AC to H, with full kernel memory impact giving C/I/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames:
- Clear next_buffer after assigning it to server->bigbuf. A stale
next_buffer pointer can lead to a use-after-free on subsequent error paths.
- Update pdu_length to the decrypted plaintext size (buf_size). Using
the pre-decryption length allows NextCommand to point into stale ciphertext residue.
- Reject next_cmd values smaller than MID_HEADER_SIZE(server).
- Fix an integer overflow in the upper bound check by verifying
pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.
Executive ViewAI
A memory-safety flaw in the Linux kernel's CIFS/SMB client (cifs.ko) allows an attacker-controlled or man-in-the-middle SMB server to corrupt kernel memory on any Linux host that mounts or connects to that share (CVE-2026-98171, HIGH, CVSS 8.8). Because the corruption occurs in kernel space, an affected workstation or server can suffer data disclosure, data tampering, or crash and reboot, so any team relying on Linux clients to reach SMB/NAS or third-party file services carries the exposure. No public exploit has been identified at time of analysis and vendor patches are available, making rapid patch deployment a manageable, low-cost risk reduction rather than an emergency.
Apply vendor patch. Until the patched kernel is running, limit Linux SMB clients to trusted, internally controlled servers, block outbound SMB (TCP 445/139) to untrusted or external networks, avoid mounting shares over untrusted links where man-in-the-middle is possible, and maintain host-level monitoring and recovery for unexpected kernel crashes on SMB client systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB