Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a huge size_t. The later subtraction wraps the __u16 bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the slab object, and the bytes reach userspace through tcon->nativeFileSystem in /proc/fs/cifs/DebugData. Reject a byte area too small for what the parser consumes. Two bytes is the least it can consume, and no conformant response carries fewer. The new trace point is the 129th smb_eio_trace entry, which __mode(byte) cannot represent, so the attribute goes with it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T20:19:48.640Z",
  "pubdate": "2026-09-11T20:19:48.640Z",
  "executiveSummary": "This vulnerability is an out-of-bounds (OOB) read condition affecting the Linux kernel CIFS/SMB client implementation. The issue arises from improper validation of the ByteCount field within a tree connect (TCon) response from a server. An unauthenticated or malicious SMB server can send a specially crafted, undersized response, triggering an integer underflow during string length calculations. This leads to the kernel accessing memory outside the allocated buffer boundaries of the cifs_req_poolp slab object. The primary impact is an information disclosure vulnerability, where sensitive heap data can be leaked to userspace via the /proc/fs/cifs/DebugData interface. Attackers with the ability to act as a malicious SMB server can exfiltrate kernel memory contents, potentially bypassing security mechanisms like KASLR or extracting sensitive credentials. Successful exploitation requires the client to mount a malicious share. The vulnerability highlights a critical lack of input sanitization for network-supplied length fields in the SMB client protocol stack.",
  "technicalDetails": "The root cause of the vulnerability lies in the CIFSTCon() function within the Linux kernel's SMB client, which fails to adequately validate the ByteCount field of the SMB tree connect response. When processing this response, the function executes a strnlen() operation bounded by the server-supplied ByteCount minus two. In scenarios where the ByteCount is 0 or 1, the arithmetic operation results in a negative integer. Due to implicit casting to size_t, this value is interpreted as a massive unsigned integer.\nDuring subsequent operations, the __u16 bytes_left variable undergoes a subtraction that wraps around, resulting in a large value that governs the boundaries for the cifs_strndup_from_utf16() function. This function attempts to copy data from the network buffer into a smaller destination buffer, specifically a cifs_req_poolp slab object which typically resides within a ~16 KB memory region. Because the effective bound is incorrectly calculated up to 65535 bytes, the function continues reading past the allocated slab object's end.\nThe exploitation flow proceeds as follows: 1) An attacker sets up a malicious SMB server or intercepts legitimate traffic. 2) The attacker forces the Linux kernel client to initiate a tree connect request. 3) The attacker responds with a malicious SMB packet where the ByteCount field is set to 0 or 1. 4) The client's kernel processing logic performs an integer underflow, calculating an extremely large buffer size for string copying. 5) The cifs_strndup_from_utf16() function performs an out-of-bounds read from the heap, capturing adjacent memory contents into the tcon->nativeFileSystem structure. 6) The attacker retrieves the leaked memory by reading the /proc/fs/cifs/DebugData file, which exposes the contents of the tcon->nativeFileSystem buffer to userspace.\nThis vulnerability is particularly dangerous as it allows for the remote leakage of kernel memory. Given that the data is exposed via /proc, it can be harvested by any user with sufficient permissions to access the CIFS debug information. The flaw demonstrates a classic failure in protocol boundary checking, where the input length is trusted without verifying that it matches the actual structure of the expected payload, leading to direct memory corruption or disclosure."
}