CVE-2026-43185 ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
A signedness bug in the Linux kernel's ksmbd module allows attackers to trigger a heap buffer overflow via crafted SMB messages, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43185?
CVE-2026-43185 is a critical vulnerability in Linux kernel, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message.
By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow.
This fix replaces min_t(int, ...) with min_t(u32)
Weakness: CWE-674
Which versions are affected by CVE-2026-43185?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43185?
Apply the vendor's patch.
Is CVE-2026-43185 being exploited?
There is no known exploitation of CVE-2026-43185 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43185, DEBIAN-CVE-2026-43185, GHSA-vcg7-gx5w-x44c, ROOT-OS-DEBIAN-12-CVE-2026-43185, ROOT-OS-DEBIAN-13-CVE-2026-43185, ROOT-OS-UBUNTU-2204-CVE-2026-43185 and 2 more.