Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); data_area_of_tgt += total_in_tgt; ... memcpy(data_area_of_tgt, data_area_of_src, total_in_src); A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target). The BCC overflow guard does not prevent this: BCC reflects how much data is present, while DataOffset controls where in the buffer it starts. The "validate target area" comment present since the function was first written in 2005 was a placeholder that was never implemented. Add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:48.887Z",
  "pubdate": "2026-09-11T20:19:48.887Z",
  "executiveSummary": "A critical out-of-bounds (OOB) read/write vulnerability exists in the Linux kernel's SMB client implementation, specifically within the coalesce_t2() function.\nThe vulnerability stems from the processing of unvalidated DataOffset fields provided by the SMB server, which determine memory offsets for data copy operations.\nAn unauthenticated or malicious SMB server can leverage this flaw to trigger out-of-bounds heap memory access, leading to potential memory corruption, information disclosure, or system instability.\nBy manipulating the DataOffset values, an attacker can influence the destination and source memory addresses used during memcpy operations, effectively bypassing existing Byte Count (BCC) protections.\nThis represents a high-risk scenario for systems mounting untrusted SMB shares, as successful exploitation could lead to privilege escalation or kernel-level code execution depending on the state of the kernel heap.\nThe issue highlights a long-standing absence of input validation regarding SMB transaction header offsets, which were previously left as unimplemented placeholders.",
  "technicalDetails": "The vulnerability resides in the coalesce_t2() function within the Linux kernel SMB client. The function is responsible for assembling fragmented SMB Transaction2 (T2) responses by copying data from a source buffer into a target buffer using memcpy().\nThe root cause of the vulnerability is the lack of bounds checking on the 'DataOffset' field extracted from the SMB header (pSMBt->t2_rsp.DataOffset and pSMBs->t2_rsp.DataOffset). The kernel uses these fields to calculate absolute memory pointers (data_area_of_tgt and data_area_of_src) relative to the protocol header.\nBecause these offsets are derived directly from network-supplied data without verification against the actual buffer size, they are susceptible to manipulation. If a DataOffset is excessively small, the resulting pointer calculation can point to memory addresses preceding the data area, potentially corrupting critical kernel structures or header fields. Conversely, an excessively large DataOffset can result in pointers exceeding the allocated buffer boundaries.\nThe existing Byte Count (BCC) validation is insufficient as it only restricts the total length of the data to be copied, rather than the starting location of the data within the buffer. Consequently, the memcpy operation operates on memory regions outside the intended packet structures.\nExploitation flow involves an attacker acting as a malicious SMB server. When the victim client initiates a T2 transaction, the attacker provides a crafted T2 response containing a manipulated DataOffset value. Upon receiving this, the coalesce_t2() function calculates the malicious pointers. The subsequent memcpy operation then performs an unauthorized write (OOB write) or read (OOB read) based on these pointers.\nAn OOB write allows the attacker to overwrite sensitive kernel memory or adjacent heap objects, which can be weaponized to achieve arbitrary code execution. An OOB read allows for the leakage of sensitive information from kernel memory back to the attacker, potentially aiding in the bypass of KASLR or other memory protection mechanisms.\nThis vulnerability is reachable by any client process that initiates an SMB mount, making the exposure dependent on network connectivity to an attacker-controlled server. No specific user-level privileges are required on the victim system beyond the ability to trigger an SMB transaction."
}