Linux Kernel EUVD-2026-59209

The vulnerability resides in the Linux kernel's CIFS/SMB2 client module, specifically in smb2_ioctl_query_info(), which processes PASSTHRU_FSCTL ioctl responses received from SMB2 servers. The root cause is an integer overflow in the bounds validation logic: both OutputOffset and qi.input_buffer_length are derived from 32-bit fields in the SMB response, and their direct addition in 32-bit arithmetic can silently wrap around before the result is compared against the response buffer length. A server-controlled overflow makes the wrapped sum appear in-bounds, so the subsequent copy_to_user() call reads from io_rsp + OutputOffset, which points outside the allocated response buffer - potentially into adjacent kernel memory. The fix replaces the raw addition with size_add(), a kernel helper that treats overflow as out-of-bounds. Although no CWE is formally assigned in the NVD record, the flaw maps clearly to CWE-190 (Integer Overflow or Wraparound) compounded by CWE-125 (Out-of-bounds Read). Affected CPE: cpe:2.3:a:linux:linux across all branches containing commit 2b1116bbe898aefdf584838448c6869f69851e0f prior to each branch's respective fix commit.