CVE-2026-98454

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix create context out-of-bounds reads

smb2_parse_contexts() validates the complete create-context area but

does not limit each record to its Next field before dispatching it. A

malformed chain can therefore expose bytes beyond the current context to

a handler. The QFid handler also used a full response-structure cast

although it only reads DiskFileId.

The SMB2/SMB3 lease parsers made the same layout assumption: they read

LeaseState and LeaseFlags at canonical offsets rather than at

DataOffset. A valid non-canonical DataOffset could therefore yield

unrelated in-bounds data, while a short DataLength was still accepted.

Limit each context to its Next value, reject offsets before the context

header, and reject malformed chains. Bound the name range by the current

context and do not dispatch a known handler when DataLength is zero. Read

the QFid DiskFileId only when the context data covers that field.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References