CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()
A malicious SMB server can trigger out-of-bounds reads in the Linux kernel SMB client, potentially leaking kernel memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98405?
CVE-2026-98405 is a high-severity memory corruption vulnerability in Linux, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix missing iov bounds check in parse_posix_sids()
In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len).
If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory.
Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.
Which versions are affected by CVE-2026-98405?
How do I fix CVE-2026-98405?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98405 being exploited?
There is no known exploitation of CVE-2026-98405 in the wild and no public exploit code.
Sources
Also known as AZL-108146, BELL-CVE-2026-98405, GHSA-gf4w-8ph4-r9fj, UBUNTU-CVE-2026-98405.