Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_data() error context loop The check added by commit 7d9a7f1f96cd ("smb/client: fix possible infinite loop and oob read in symlink_data()") compared the post-ALIGN length against the remaining buffer, but ALIGN() itself can overflow: for ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8) wraps to 0, so the subsequent bounds check passes, and the loop advances by zero bytes leaving 'p' pointing into stale data. Fix by checking the raw ErrorDataLength against the remaining space before applying ALIGN(), then checking again after. Since raw_len is bounded by the buffer, raw_len + 7 cannot overflow, so the second check is an exact post-alignment bounds guard.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-11T20:19:49.010Z",
  "pubdate": "2026-09-11T20:19:49.010Z",
  "executiveSummary": "The Linux kernel SMB client contains an integer overflow vulnerability within the symlink_data() function that can lead to an infinite loop or out-of-bounds (OOB) memory access.\nThe vulnerability arises from improper handling of ErrorDataLength values during alignment calculations, specifically when the length is near the UINT32_MAX threshold.\nAn unprivileged remote attacker with the ability to influence SMB server responses could potentially trigger a denial-of-service (DoS) condition or extract sensitive memory contents via OOB reads.\nThis vulnerability affects the SMB client implementation in the Linux kernel. Successful exploitation requires an attacker to provide a specially crafted malicious SMB packet that induces the overflow during the alignment process.\nThe impact is significant, as it permits memory corruption patterns within the kernel space, potentially leading to system instability or information leakage.",
  "technicalDetails": "The root cause of the vulnerability lies in the use of the ALIGN() macro on the ErrorDataLength parameter without prior validation of the raw value. When ErrorDataLength is set to a value near UINT32_MAX (e.g., 0xFFFFFFF9), the expression ALIGN(x, 8) wraps around to zero due to integer overflow.\nPrevious security implementations, specifically commit 7d9a7f1f96cd, attempted to mitigate infinite loops and OOB reads by validating the post-alignment length against the remaining buffer size. However, because the alignment calculation itself overflows, the subsequent bounds check effectively evaluates a zero-length increment against a valid remaining buffer size.\nThe exploitation flow begins when the SMB client parses a response from a malicious server. The parser processes the ErrorDataLength field. When an attacker provides a crafted value, the vulnerable symlink_data() function passes this value to ALIGN(). Because the calculation wraps to zero, the loop responsible for iterating through the buffer fails to advance the pointer 'p'.\nThis failure to advance the pointer results in an infinite loop, as the loop condition remains satisfied while the buffer offset remains static. Furthermore, because the bounds check passes against the zero-aligned value, the logic proceeds to access or parse data based on the stale pointer position. This leads to persistent OOB read operations where the pointer 'p' repeatedly references the same memory location, or interprets stale memory as valid response data.\nThe payload behavior involves the attacker sending an SMB response with a carefully calculated ErrorDataLength that induces the overflow. This forces the kernel to process the same memory segment repeatedly or interpret out-of-bounds memory as legitimate SMB response structures. This leads to either kernel-level DoS or the potential disclosure of kernel stack/heap memory contents to the user-space client."
}