CVE-2026-72310smb: client: fix overflow in passthrough ioctl bounds check
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix overflow in passthrough ioctl bounds check smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload before copying it to userspace. The payload offset and length both come from 32-bit fields. The bounds check currently adds OutputOffset and qi.input_buffer_length directly, so the addition can wrap in 32-bit arithmetic before the result is compared against the response buffer length. A malicious server can use a large OutputOffset and a small OutputCount to make the wrapped sum pass the bounds check. The later copy_to_user() then reads from io_rsp + OutputOffset, outside the response buffer. Use size_add() for the offset plus length check so overflow is treated as out of bounds.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2b1116bbe898aefdf584838448c6869f69851e0f before 175357ee0c596cb82054650dfa32fda51ad35aaa; from 2b1116bbe898aefdf584838448c6869f69851e0f before dbd126539c098dba3159ce7d34b10b2daddcbd0f; from 2b1116bbe898aefdf584838448c6869f69851e0f before 63feb687e89a3a52a31e6e01764117cc500f1974; from 2b1116bbe898aefdf584838448c6869f69851e0f before 160045fc943f6c46b227644261252c8a22b8a87a; from 2b1116bbe898aefdf584838448c6869f69851e0f before b30771b69eafae750afb7385fbcc3d77ed3f3670; from 2b1116bbe898aefdf584838448c6869f69851e0f before 1627e7d5c9b09721a141d07cedb178882f1ded67; 2b1116bbe898aefdf584838448c6869f69851e0f builds before 1a638c55f2db6cb2296e5e3138015dd8fd9d4aa9; from 2b1116bbe898aefdf584838448c6869f69851e0f before a4f27ad055392fa164f5649e89a3637b033c5fcc; and 2 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/175357ee0c596cb82054650dfa32fda51ad35aaa
- https://git.kernel.org/stable/c/dbd126539c098dba3159ce7d34b10b2daddcbd0f
- https://git.kernel.org/stable/c/63feb687e89a3a52a31e6e01764117cc500f1974
- https://git.kernel.org/stable/c/160045fc943f6c46b227644261252c8a22b8a87a
- https://git.kernel.org/stable/c/b30771b69eafae750afb7385fbcc3d77ed3f3670
- https://git.kernel.org/stable/c/1627e7d5c9b09721a141d07cedb178882f1ded67
- https://git.kernel.org/stable/c/1a638c55f2db6cb2296e5e3138015dd8fd9d4aa9
- https://git.kernel.org/stable/c/a4f27ad055392fa164f5649e89a3637b033c5fcc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.