smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.54 % · centile 45 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames: - Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths. - Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject next_cmd values smaller than MID_HEADER_SIZE(server). - Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.
Références
- https://git.kernel.org/stable/c/1ed29f7a03417b405f38c09cfe04124883127b53
- https://git.kernel.org/stable/c/7f022867ec9f0166a0b4400385bb601b1c6b2c75
- https://git.kernel.org/stable/c/72eaef1f37a3b6bec11c342736834dc3707be3e4
- https://git.kernel.org/stable/c/491e33144dee872cffda207f6fcb09260728f803
- https://git.kernel.org/stable/c/8749946579708ea0d339034bb7f423a67dbe89cf
- https://git.kernel.org/stable/c/96c436e4b010711452b2872558938f4ef276492a
- https://git.kernel.org/stable/c/858d5ac22cb889266993e7670f9f0c4f4aeedd78
- https://git.kernel.org/stable/c/05762c5bc1cfdcac36747994fde2c04387a457f1
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-93099
- GCVE · GCVE-0-2026-98171
Avis du CERT-FR
- CERTFR-2026-AVI-1432 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1374 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected b24df3e30cbf48255db866720fb71f14bf9d2f39 < 1ed29f7a03417b405f38c09cfe04124883127b53 ; affected b24df3e30cbf48255db866720fb71f14bf9d2f39 < 7f022867ec9f0166a0b4400385bb601b1c6b2c75 ; affected b24df3e30cbf48255db866720fb71f14bf9d2f39 < 72eaef1f37a3b6bec11c342736834dc3707be3e4 ; affected b24df3e30cbf48255db866720fb71f14bf9d2f39 < 491e33144dee872cffda207f6fcb09260728f803 ; affected b24df3e30cbf48255db866720fb71f14bf9d2f39 < 8749946579708ea0d339034bb7f423a67dbe89cf ; affected b24df3e30cbf48255db866720fb71f14bf9d2f39 < 96c436e4b010711452b2872558938f4ef276492a |
| Linux · Linux | affected 4.19 ; unaffected 0 < 4.19 ; unaffected 5.10.273 ≤ 5.10.* ; unaffected 5.15.224 ≤ 5.15.* ; unaffected 6.1.189 ≤ 6.1.* ; unaffected 6.6.158 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |