CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

Not scored Published 6 Oct 2026 Updated 21 Oct 2026

Out-of-bounds reads in the Linux kernel SMB client allow attackers to cause denial of service or disclose memory contents via malformed server responses.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-98170?

CVE-2026-98170 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is insufficient. It allows iteration to continue even if the remaining src_size is too small to contain a complete smb2_ea_info structure. Consequently, reads of ea_name_length and ea_value_length can occur out-of-bounds.

Fix this by ensuring src_size >= sizeof(*src) before attempting to read any structure fields. Additionally, reject any next_entry_offset that is smaller than sizeof(*src) or that would advance the pointer beyond the available buffer.

Note that for calls where the server returns a malformed EA list, the error returned to userspace changes from -ENODATA (getxattr) or -ERANGE (listxattr) to -EIO. This correctly signals a server protocol error rather than misleadingly indicating "attribute not present" or "output buffer too small".

Which versions are affected by CVE-2026-98170?

How do I fix CVE-2026-98170?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-98170 being exploited?

There is no known exploitation of CVE-2026-98170 in the wild and no public exploit code.

Sources

Also known as AZL-105975, BELL-CVE-2026-98170, DEBIAN-CVE-2026-98170, GHSA-qx7m-524h-7684, UBUNTU-CVE-2026-98170.