CVE-2026-98169

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix potential OOB read in smb3_enum_snapshots()

If snapshot_array_size is smaller than GMT_TOKEN_SIZE,

smb3_enum_snapshots() sets ret_data_len to

sizeof(struct smb_snapshot_array) without verifying the actual length

of the server's reply.

Because SMB2_ioctl() places no lower bound on the server-supplied

OutputCount and allocates retbuf to exactly that length, a short reply

results in ret_data_len exceeding the size of retbuf. The subsequent

copy_to_user() then reads past the end of retbuf, leaking adjacent slab

memory to userspace. The subsequent clamp check is ineffective as it

only reduces ret_data_len.

Fix this by rejecting replies shorter than

sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set

to the 12-byte struct size rather than the 16-byte

MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes

is exactly what copy_to_user() attempts to read.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References