CVE-2026-98169 smb: client: fix potential OOB read in smb3_enum_snapshots()
A local attacker can trigger an out-of-bounds read in the Linux kernel SMB client to leak adjacent slab memory to userspace.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-98169?
CVE-2026-98169 is a high-severity vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential OOB read in smb3_enum_snapshots()
If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual length of the server's reply.
Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in ret_data_len exceeding the size of retbuf. The subsequent copy_to_user() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces ret_data_len.
Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copy_to_user() attempts to read.
Which versions are affected by CVE-2026-98169?
How do I fix CVE-2026-98169?
Apply the vendor's patch.
Is CVE-2026-98169 being exploited?
There is no known exploitation of CVE-2026-98169 in the wild and no public exploit code.
Sources
Also known as AZL-105996, BELL-CVE-2026-98169, DEBIAN-CVE-2026-98169, GHSA-2c6m-5vjc-xqc6, UBUNTU-CVE-2026-98169.