CVE-2026-72310 smb: client: fix overflow in passthrough ioctl bounds check
A malicious SMB server can trigger an integer overflow in the Linux kernel client, leading to out-of-bounds memory reads and potential information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72310?
CVE-2026-72310 is a high-severity vulnerability in Linux, published on 15 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix overflow in passthrough ioctl bounds check
smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace.
The payload offset and length both come from 32-bit fields. The bounds check currently adds OutputOffset and qi.input_buffer_length directly, so the addition can wrap in 32-bit arithmetic before the result is compared against the response buffer length.
A malicious server can use a large OutputOffset and a small OutputCount to make the wrapped sum pass the bounds check. The later copy_to_user() then reads from io_rsp + OutputOffset, outside the response buffer.
Use size_add() for the offset plus length check so overflow is treated as out of bounds.
Which versions are affected by CVE-2026-72310?
How do I fix CVE-2026-72310?
Apply the vendor's patch.
Is CVE-2026-72310 being exploited?
There is no known exploitation of CVE-2026-72310 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72310, DEBIAN-CVE-2026-72310, GHSA-h4wv-r484-2rg5, UBUNTU-CVE-2026-72310.