Description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject a tree connect response whose byte count is too small
CIFSTCon() bounds its strnlen() over the byte area with the server's
ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int
and converts to a huge size_t. The later subtraction wraps the __u16
bytes_left, and that is what bounds cifs_strndup_from_utf16(): a bound of
up to 65535 against a ~16 KB cifs_req_poolp object runs off the end of the
slab object, and the bytes reach userspace through tcon->nativeFileSystem
in /proc/fs/cifs/DebugData.
Reject a byte area too small for what the parser consumes. Two bytes is
the least it can consume, and no conformant response carries fewer. The
new trace point is the 129th smb_eio_trace entry, which __mode(byte)
cannot represent, so the attribute goes with it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 2.6.30 | 6.1.191 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.2.6-1 | — |
| Debian 13 | linux | 6.12.115-2 | — |
| Debian 12 | linux | No fix yet | — |
| Debian 12 | linux-6.12 | 6.12.115-2~deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | No fix yet | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-42.42 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-aws | 7.0.0-1016.17 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-azure | 7.0.0-1020.21 | USN-9019-1 |
| Ubuntu 26.04 LTS | linux-azure-fde | 7.0.0-1019.19 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-gcp | 7.0.0-1016.18 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-gke | 7.0.0-1010.11 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1017.17 | USN-8960-1, USN-8959-1 |
| Ubuntu 26.04 LTS | linux-nvidia +1 | No fix yet | — |
| Ubuntu 26.04 LTS | linux-oracle | 7.0.0-1015.16 | USN-8959-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1023.23 | USN-9021-1 |
| Ubuntu 26.04 LTS | linux-realtime | 7.0.0-43.43.1 | USN-9020-1 |
| Ubuntu 26.04 LTS | linux-riscv | 7.0.0-42.42.1 | — |
| Ubuntu 24.04 LTS | linux +45 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-aws-7.0 | 7.0.0-1017.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-azure-fde-7.0 | 7.0.0-1019.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-gcp-7.0 | 7.0.0-1017.19~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-42.42~24.04.1 | USN-8959-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1038.42 | USN-9002-1 |
| Ubuntu 24.04 LTS | linux-oracle-7.0 | 7.0.0-1016.18~24.04.1 | USN-9020-1 |
| Ubuntu 24.04 LTS | linux-riscv-7.0 | 7.0.0-42.42.1~24.04.1 | — |
| Ubuntu 22.04 LTS | linux +59 | No fix yet | — |
Show 18 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime +3 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime +2 | No fix yet | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux +21 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | linux +12 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux +3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +77 | 6.12.0-211.67.1.el10_2 | RHSA-2026:85321 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.176.1.rt7.517.el8_10 | RHSA-2026:85774 |
| RHEL 8 | perf +26 | 4.18.0-553.176.1.el8_10 | RHSA-2026:85773 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Shadow Migration Toolkit 10 | kernel-modules-internal | 6.12.0-211.67.1.el10_2 | RHSA-2026:85321 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rv +74 | 6.12.0-211.67.1.el10_2 | ALSA-2026:85321 |
| AlmaLinux 8 | kernel-rt +9 | 4.18.0-553.176.1.rt7.517.el8_10 | ALSA-2026:85774 |
| AlmaLinux 8 | perf +24 | 4.18.0-553.176.1.el8_10 | ALSA-2026:85773 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | kernel | 6.12.0-211.67.1.el10_2 | RLSA-2026:85321 |
| Rocky Linux 9 | rv +75 | 5.14.0-741.20.1.el9_9 | RLSA-2026:97873 |
| Rocky Linux 8 | kernel | 4.18.0-553.176.1.el8_10 | RLSA-2026:85773 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.176.1.rt7.517.el8_10 | RLSA-2026:85774 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +7 | 6.4.0-150700.53.84.1 | SUSE-SU-2026:4706-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.84.1.150700.17.47.1 | SUSE-SU-2026:4706-1 |
| SLES 15 SP6 | kernel-64kb +6 | 6.4.0-150600.23.138.1 | SUSE-SU-2026:4660-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.138.1.150600.12.64.1 | SUSE-SU-2026:4660-1 |
| SLES 15 SP5 | kernel-64kb +4 | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLES 15 SP5 | kernel-default-base | 5.14.21-150500.55.192.2.150500.6.89.2 | SUSE-SU-2026:4667-1 |
| SLES 15 SP5 | kernel-docs +1 | 5.14.21-150500.55.192.1 | SUSE-SU-2026:4667-1 |
| SLES 15 SP4 | kernel-64kb +6 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLES 15 SP4 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.339.1 | SUSE-SU-2026:5121-1 |
Show 19 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.40.1 | SUSE-SU-2026:24446-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.40.1.160000.2.29 | SUSE-SU-2026:24446-1 |
| SLES for SAP 15 SP6 | kernel-default-base | 6.4.0-150600.23.138.1.150600.12.64.1 | SUSE-SU-2026:4660-1 |
| SLES for SAP 15 SP6 | kernel-docs +4 | 6.4.0-150600.23.138.1 | SUSE-SU-2026:4660-1 |
| SLES for SAP 15 SP5 | kernel-default-base | 5.14.21-150500.55.192.2.150500.6.89.2 | SUSE-SU-2026:4667-1 |
| SLES for SAP 15 SP5 | kernel-docs +1 | 5.14.21-150500.55.192.1 | SUSE-SU-2026:4667-1 |
| SLES for SAP 15 SP5 | kernel-source +2 | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLES for SAP 15 SP4 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SLES for SAP 15 SP4 | kernel-docs +4 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.40.1 | SUSE-SU-2026:24446-1, SUSE-SU-2026:24437-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.40.1.160000.2.29 | SUSE-SU-2026:24446-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.40.1.160000.2.29 | SUSE-SU-2026:24422-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.40.1 | SUSE-SU-2026:24422-1, SUSE-SU-2026:24386-1 |
| SLE Micro 6.2 | podman | 5.4.2-160000.6.1 | SUSE-SU-2026:24182-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-159998.53.1.159998.21.38 | SUSE-SU-2026:24181-1 |
| SLE Micro 6.1 | kernel-rt +4 | 6.4.0-159998.53.1 | SUSE-SU-2026:24182-1, SUSE-SU-2026:24181-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-159998.53.1.159998.21.38 | SUSE-SU-2026:24315-1 |
| SLE Micro 6.0 | kernel-rt +4 | 6.4.0-159998.53.1 | SUSE-SU-2026:24316-1, SUSE-SU-2026:24315-1 |
| SLE Micro 5.5 | kernel-default-base | 5.14.21-150500.55.192.2.150500.6.89.2 | SUSE-SU-2026:4667-1 |
| SLE Micro 5.5 | kernel-rt +1 | 5.14.21-150500.13.164.1 | SUSE-SU-2026:4665-1 |
| SLE Micro 5.5 | kernel-source +1 | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLE Micro 5.4 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SLE Micro 5.4 | kernel-rt +1 | 5.14.21-150400.15.189.1 | SUSE-SU-2026:4666-1 |
| SLE Micro 5.4 | kernel-source +1 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLE Micro 5.3 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SLE Micro 5.3 | kernel-rt +1 | 5.14.21-150400.15.189.1 | SUSE-SU-2026:4666-1 |
| SLE Micro 5.3 | kernel-source +1 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.84.1 | SUSE-SU-2026:4706-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_21 | 1-150700.1.3.1 | SUSE-SU-2026:4640-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_22 | 1-150700.15.3.1 | SUSE-SU-2026:4706-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.138.1 | SUSE-SU-2026:4660-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_32 | 1-150600.13.3.1 | SUSE-SU-2026:4660-1 |
| SLE Live Patching 15 SP5 | kernel-default | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLE Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_46 | 1-150500.11.3.2 | SUSE-SU-2026:4667-1 |
| SLE Live Patching 15 SP4 | kernel-default | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLE Live Patching 15 SP4 | kernel-livepatch-SLE15-SP4_Update_60 | 1-150400.9.3.1 | SUSE-SU-2026:4668-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.339.1 | SUSE-SU-2026:5121-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_90 | 1-8.3.1 | SUSE-SU-2026:5121-1 |
| SLE HPC 15 SP5 | kernel-64kb +3 | 5.14.21-150500.55.192.2 | SUSE-SU-2026:4667-1 |
| SLE HPC 15 SP5 | kernel-default-base | 5.14.21-150500.55.192.2.150500.6.89.2 | SUSE-SU-2026:4667-1 |
| SLE HPC 15 SP5 | kernel-docs +1 | 5.14.21-150500.55.192.1 | SUSE-SU-2026:4667-1 |
| SLE HPC 15 SP4 | kernel-64kb +5 | 5.14.21-150400.24.243.1 | SUSE-SU-2026:4668-1 |
| SLE HPC 15 SP4 | kernel-default-base | 5.14.21-150400.24.243.1.150400.24.122.1 | SUSE-SU-2026:4668-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +2 | 6.4.0-150700.7.78.1 | SUSE-SU-2026:4640-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.2.7-1.1 | openSUSE-SU-2026:11880-1 |
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.40.1.160000.2.29 | openSUSE-SU-2026:22167-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.40.1 | openSUSE-SU-2026:22167-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.51-120.162 +1 | 1:1.0-0.amzn2023 | ALAS2023-2026-3402, ALAS2023-2026-3187 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.114-139.210.amzn2023 | ALAS2023-2026-3402 |
| Amazon Linux 2023 | perf6.18 +12 | 1:6.18.51-120.162.amzn2023 | ALAS2023-2026-3187 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.161.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rv +29 | 6.12.0-211.67.1.el10_2 | ELSA-2026-85321 |
| Oracle Linux 8 | perf +19 | 4.18.0-553.176.1.el8_10 | ELSA-2026-85773 |
Advisories 39
- ALSA-2026:85774 Important: kernel-rt security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 13, 2026
- RLSA-2026:97873 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- USN-9021-1 linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- WID-SEC-2026-3321 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-9020-1 linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8959-1 linux, linux-aws, linux-gcp, linux-hwe-7.0, linux-ibm, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9019-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-8960-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- USN-9002-1 linux-nvidia-tegra vulnerabilities Ubuntu Security Notices (USN) · Nov 12, 2026
- ALAS2023-2026-3402 Important: kernel6.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 11, 2026
- SUSE-SU-2026:5121-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 6, 2026
- ALSA-2026:85321 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 6, 2026
- ALSA-2026:85773 Important: kernel security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 6, 2026
- SUSE-SU-2026:24437-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 1, 2026
- SUSE-SU-2026:24446-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Nov 1, 2026
- SUSE-SU-2026:24422-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 30, 2026
- SUSE-SU-2026:24386-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 30, 2026
- SUSE-SU-2026:24315-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 27, 2026
- SUSE-SU-2026:24316-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 27, 2026
- openSUSE-SU-2026:22167-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 25, 2026
- RLSA-2026:85321 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 21, 2026
- RLSA-2026:85773 Important: kernel security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 21, 2026
- RLSA-2026:85774 Important: kernel-rt security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 21, 2026
- SUSE-SU-2026:24181-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 20, 2026
- SUSE-SU-2026:24182-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 20, 2026
- RHSA-2026:85773 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:85774 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:85321 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-85321 Important: kernel security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 20, 2026
- ELSA-2026-85773 Important: kernel security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 20, 2026
- SUSE-SU-2026:4706-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 17, 2026
- SUSE-SU-2026:4666-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 16, 2026
- SUSE-SU-2026:4667-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 16, 2026
- SUSE-SU-2026:4665-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 15, 2026
- SUSE-SU-2026:4668-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 15, 2026
- SUSE-SU-2026:4660-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 14, 2026
- SUSE-SU-2026:4640-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Oct 14, 2026
- ALAS2023-2026-3187 Important: kernel6.18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 12, 2026
- openSUSE-SU-2026:11880-1 kernel-devel-7.2.7-1.1 on GA media SUSE / openSUSE Security Updates · Sep 25, 2026
References
- https://git.kernel.org/stable/c/bb99866cb1d3d5e8201200a8692fd8da3106a8fd
- https://git.kernel.org/stable/c/d837645a719151ed392d4d9cab4571c2753dab12
- https://git.kernel.org/stable/c/2ae219762ebac929bf6ab3473681f10ed566af08
- https://git.kernel.org/stable/c/3be89e8039a85fa3b6cd5f9dcc4c1459eb356c2d
- https://git.kernel.org/stable/c/411e484fe71a7f1028de617447edad9cb6d9d68a
- https://git.kernel.org/stable/c/65deb18359341141d37dc86fc7853511be3c87a7