Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the data_offset bound in is_valid_oplock_break() Commit 83bfbd0bb902 ("cifs: Remove the RFC1002 header from smb_hdr") changed the quantity this bound is measured against. It used to be srv->total_read minus the 4-byte RFC1002 preamble that total_read then included, so it was the SMB message length. The same commit stopped counting the preamble, and the mechanical substitution to srv->total_read - srv->pdu_size left an expression that is identically zero: standard_receive3() reads MID_HEADER_SIZE() bytes and then exactly pdu_length - MID_HEADER_SIZE() more, adding both to total_read. len is therefore 0, the subtraction below it wraps, and no __u32 DataOffset can exceed the result, so the check from commit 097f5863b1a0 ("cifs: read overflow in is_valid_oplock_break()") no longer rejects anything. Use total_read, which is now the message length on its own.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T20:19:48.517Z",
  "pubdate": "2026-09-11T20:19:48.517Z",
  "executiveSummary": "This vulnerability is an out-of-bounds access issue affecting the Linux kernel CIFS client, specifically within the is_valid_oplock_break function.\nThe flaw stems from an incorrect calculation of data length bounds following a structural refactoring of the RFC1002 header handling.\nThe issue permits the bypass of previously implemented safety checks designed to prevent data offset overflows during oplock break processing.\nAn unauthenticated remote attacker capable of sending malicious SMB responses to a CIFS client could exploit this vulnerability to trigger an out-of-bounds read or potential memory corruption.\nThis could result in system instability, kernel crashes (Denial of Service), or potential information disclosure by manipulating the DataOffset field in incoming SMB packets.\nThe risk is elevated due to the kernel-level nature of the vulnerability, where successful exploitation grants the attacker influence over memory handling within the network subsystem.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper calculation of message length bounds in the is_valid_oplock_break function after the commit 83bfbd0bb902 refactored how the RFC1002 header is parsed.\nPreviously, srv->total_read included the 4-byte RFC1002 preamble; however, the refactoring caused srv->total_read to no longer include this preamble. In the vulnerable code, the logic calculated the allowed data offset relative to srv->total_read minus srv->pdu_size.\nDue to the change in how total_read is accumulated in standard_receive3, the expression 'srv->total_read - srv->pdu_size' evaluates to zero. Consequently, the length (len) variable becomes zero, and subsequent integer subtractions effectively wrap around, causing the data offset validation check to fail silently.\nThe validation logic intended to ensure that the __u32 DataOffset field within the SMB message does not exceed the remaining buffer size is effectively bypassed, as the constraint comparison is performed against an invalid, zero-length boundary.\nAttack flow: A remote malicious SMB server transmits a crafted packet containing an oplock break notification. The client kernel receives this packet and executes is_valid_oplock_break. Because the safety check is bypassed due to the mathematical error, the kernel trusts an attacker-controlled DataOffset value.\nExploitation involves the attacker manipulating the DataOffset field to point outside the allocated memory buffer for the SMB packet. When the kernel subsequently attempts to access data at the provided offset, it results in an out-of-bounds read. Depending on the memory layout and the specific field being accessed, this may lead to sensitive kernel memory exposure or a kernel panic leading to DoS.\nThis vulnerability is present in versions of the Linux kernel where commit 83bfbd0bb902 was applied without the corrective patch, specifically affecting CIFS/SMB client implementations. It requires the client to connect to a malicious or compromised SMB server that sends malformed oplock break responses, making it a network-facing vulnerability that does not necessarily require local authentication."
}