CVE-2026-98169

High

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOB read in smb3_enum_snapshots() If snapshot_array_size is smaller than GMT_TOKEN_SIZE, smb3_enum_snapshots() sets ret_data_len to sizeof(struct smb_snapshot_array) without verifying the actual length of the server's reply. Because SMB2_ioctl() places no lower bound on the server-supplied OutputCount and allocates retbuf to exactly that length, a short reply results in ret_data_len exceeding the size of retbuf. The subsequent copy_to_user() then reads past the end of retbuf, leaking adjacent slab memory to userspace. The subsequent clamp check is ineffective as it only reduces ret_data_len. Fix this by rejecting replies shorter than sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set to the 12-byte struct size rather than the 16-byte MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes is exactly what copy_to_user() attempts to read.

Package Linux Kernel
Published 2026-10-06
Last modified 2026-10-07
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

7.1

out of 10
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Affected versions

Linux kernel versions 4.9.125, 4.14.68, 4.18.6, 4.19 and later are affected. Fixed in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3-rc4 and their respective stable series.

Affected from
≥ 4.9.125 ≥ 4.14.68 ≥ 4.18.6 ≥ 4.19
Fixed in
✓ 6.1.189 6.1.x ✓ 6.6.158 6.6.x ✓ 6.12.112 6.12.x ✓ 6.18.54 6.18.x ✓ 7.2.8 7.2.x ✓ 7.3-rc4

References

6 total
Showing 5 of 6 references View all on NVD

Frequently asked questions

  • What is CVE-2026-98169?

    CVE-2026-98169 is a High severity Linux kernel vulnerability with a CVSS score of 7.1 out of 10 . It affects Linux kernel versions from 4.9.125 onward and has been patched in 6.1.189, 6.6.158, 6.12.112 and others. CVE-2026-98169 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2026-98169?

    CVE-2026-98169 has a CVSS score of 7.1 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H .

  • Is there a patch available for CVE-2026-98169?

    Yes. CVE-2026-98169 has been patched. Fixed versions include 6.1.189, 6.6.158, 6.12.112 and others. If you are running Linux kernel 4.9.125 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-98169 actively exploited?

    No. CVE-2026-98169 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST