CVE-2026-98454: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98454 Overview

CVE-2026-98454 is an out-of-bounds read vulnerability in the Linux kernel SMB client. The flaw resides in smb2_parse_contexts(), which validates the full create-context area but fails to constrain each record to its Next field before dispatching it to a handler. A malformed context chain can expose bytes beyond the current context to downstream handlers. The QFid handler compounded the issue by casting to a full response structure while reading only DiskFileId. SMB2 and SMB3 lease parsers made the same layout assumption, reading LeaseState and LeaseFlags at canonical offsets rather than at DataOffset.

Critical Impact
A malicious or compromised SMB server can trigger out-of-bounds reads in the Linux kernel SMB client, leading to kernel memory disclosure or client-side instability.

Affected Products

Linux kernel SMB client (fs/smb/client)
SMB2 and SMB3 lease context parsing paths
Kernels prior to the fixes referenced in the upstream stable commits

Discovery Timeline

2026-10-18 - CVE-2026-98454 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98454

Vulnerability Analysis

The vulnerability affects the SMB client's create-context parsing logic in the Linux kernel. The function smb2_parse_contexts() walks a linked chain of create-context records returned by an SMB server during open and create operations. While the parser validates the overall buffer length, it does not clamp an individual record to the boundary indicated by its own Next field before passing the record to a specific handler. A handler can therefore read past the end of the record it was invoked on and into adjacent memory.

Two handlers amplify the exposure. The QFid handler cast received data to a full response structure even though only the DiskFileId field is consumed. The SMB2 and SMB3 lease parsers read LeaseState and LeaseFlags at fixed canonical offsets instead of honoring the per-record DataOffset. A non-canonical but otherwise valid DataOffset, combined with a short DataLength, produces reads of unrelated in-bounds data that are then interpreted as lease state.

Root Cause

The root cause is missing per-record bounds enforcement during context dispatch, combined with reliance on canonical layout assumptions rather than the DataOffset and DataLength fields actually carried in each context. The condition maps to [CWE-125] Out-of-Bounds Read.

Attack Vector

Exploitation requires that the Linux client mount or connect to an attacker-controlled or compromised SMB server. The server responds to a create or open request with a crafted create-context chain containing malformed Next offsets, inconsistent DataOffset values, or zero-length DataLength entries. When the client parses the response, handlers read beyond the intended record boundaries. The result is kernel-side out-of-bounds reads that can leak memory contents into protocol state or destabilize the client.

No verified public proof-of-concept code is available. See the upstream fix commits linked in the references for the exact parser changes.

Detection Methods for CVE-2026-98454

Indicators of Compromise

Unexpected SMB client kernel warnings, oopses, or KASAN reports referencing smb2_parse_contexts, QFid, or lease parsing paths
SMB sessions to servers returning create-context chains with inconsistent Next, DataOffset, or DataLength values
Clients mounting SMB shares hosted on untrusted or newly observed external endpoints

Detection Strategies

Enable KASAN on test and canary systems to surface out-of-bounds reads in SMB client code paths during fuzzing or production triage
Inspect kernel ring buffer and dmesg for stack traces originating in fs/smb/client after SMB mount or file open operations
Correlate SMB client crashes with the remote server's IP, hostname, and reputation to identify suspicious endpoints

Monitoring Recommendations

Alert on outbound SMB (TCP 445) connections from Linux hosts to non-approved destinations
Monitor kernel version inventory to confirm patched builds are deployed across Linux fleets
Track mount events and SMB protocol dialect negotiation logs for anomalies

How to Mitigate CVE-2026-98454

Immediate Actions Required

Apply vendor-supplied Linux kernel updates that include the upstream commits fixing smb2_parse_contexts() and the lease and QFid handlers
Restrict Linux SMB client mounts to trusted, authenticated servers under administrative control
Block outbound SMB traffic from Linux systems that have no business requirement to use SMB shares

Patch Information

The fix limits each context to its Next value, rejects offsets that fall before the context header, and rejects malformed chains. The name range is bounded by the current context, and known handlers are not dispatched when DataLength is zero. The QFid handler reads DiskFileId only when the context data covers that field. The lease context is parsed from DataOffset, and DataLength must match the v1 or v2 lease_context size used by ksmbd. A size mismatch skips lease parsing without failing the open. Refer to the upstream fixes: Kernel Git Commit 05a7fd80024f, Kernel Git Commit 28bc9a87179, Kernel Git Commit 67f4c1c6a1b5, Kernel Git Commit cecc5399987, and Kernel Git Commit e4c49012708c.

Workarounds

Unload the cifs kernel module on hosts that do not require SMB client functionality
Enforce firewall egress rules that permit SMB only to a defined list of trusted file servers
Prefer alternative protocols such as NFS or object storage where feasible until patched kernels are deployed

bash

# Disable the SMB client module where SMB mounts are not required
sudo modprobe -r cifs
echo 'blacklist cifs' | sudo tee /etc/modprobe.d/disable-cifs.conf

# Restrict outbound SMB egress to approved file servers only
sudo iptables -A OUTPUT -p tcp --dport 445 -d <trusted_server_ip> -j ACCEPT
sudo iptables -A OUTPUT -p tcp --dport 445 -j DROP