CVE-2026-43362

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix in-place encryption corruption in SMB2_write()

SMB2_write() places write payload in iov[1..n] as part of rq_iov.

smb3_init_transform_rq() pointer-shares rq_iov, so crypt_message()

encrypts iov[1] in-place, replacing the original plaintext with

ciphertext. On a replayable error, the retry sends the same iov[1]

which now contains ciphertext instead of the original data,

resulting in corruption.

The corruption is most likely to be observed when connections are

unstable, as reconnects trigger write retries that re-send the

already-encrypted data.

This affects SFU mknod, MF symlinks, etc. On kernels before

6.10 (prior to the netfs conversion), sync writes also used

this path and were similarly affected. The async write path

wasn't unaffected as it uses rq_iter which gets deep-copied.

Fix by moving the write payload into rq_iter via iov_iter_kvec(),

so smb3_init_transform_rq() deep-copies it before encr

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References