Linux Kernel EUVD-2026-53785

The vulnerability resides in the Linux kernel's SMB/CIFS client implementation (smb/client), specifically in smb2_aead_req_alloc(), which allocates AEAD (Authenticated Encryption with Associated Data) encryption requests for SMBv2/v3 sessions using cipher suites such as AES-128-CCM, AES-128-GCM, or AES-256-GCM. The root cause is a C type-safety bug: the *num_sgs variable is declared as u32 (unsigned 32-bit integer), but is passed directly to ERR_PTR(), which expects a signed long representing a negative Linux kernel error code (valid range: -4095 to -1). Because u32 cannot represent negative values, ERR_PTR(*num_sgs) produces a pointer outside the kernel error pointer range. When this invalid pointer is subsequently dereferenced in the calling code, the kernel panics. The canonical fix stores the return in a signed int ret before passing to ERR_PTR(), matching the pattern used on the adjacent line. The affected code traces to commit d08089f649a0cfb2099c8551ac47eef0cc23fdf2. No CWE is formally assigned, but the class is a signed/unsigned type conversion error leading to invalid pointer generation (akin to CWE-681 or CWE-843).