{"id":"CVE-2026-72310","title":"smb: client: fix overflow in passthrough ioctl bounds check","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix overflow in passthrough ioctl bounds check\n\nsmb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload\nbefore copying it to userspace.\n\nThe …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 175357ee0c596cb82054650dfa32fda51ad35aaa","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < dbd126539c098dba3159ce7d34b10b2daddcbd0f","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 63feb687e89a3a52a31e6e01764117cc500f1974","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 160045fc943f6c46b227644261252c8a22b8a87a","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < b30771b69eafae750afb7385fbcc3d77ed3f3670","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 1627e7d5c9b09721a141d07cedb178882f1ded67","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 1a638c55f2db6cb2296e5e3138015dd8fd9d4aa9","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < a4f27ad055392fa164f5649e89a3637b033c5fcc","Linux 2005c32ec99ee2490e8131b3953f3f212009ffea","Linux >= 5.4.69 < 5.5","Linux 5.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T18:46:23.070703Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T18:55:16.690Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72310","references":[{"url":"https://git.kernel.org/stable/c/175357ee0c596cb82054650dfa32fda51ad35aaa"},{"url":"https://git.kernel.org/stable/c/dbd126539c098dba3159ce7d34b10b2daddcbd0f"},{"url":"https://git.kernel.org/stable/c/63feb687e89a3a52a31e6e01764117cc500f1974"},{"url":"https://git.kernel.org/stable/c/160045fc943f6c46b227644261252c8a22b8a87a"},{"url":"https://git.kernel.org/stable/c/b30771b69eafae750afb7385fbcc3d77ed3f3670"},{"url":"https://git.kernel.org/stable/c/1627e7d5c9b09721a141d07cedb178882f1ded67"},{"url":"https://git.kernel.org/stable/c/1a638c55f2db6cb2296e5e3138015dd8fd9d4aa9"},{"url":"https://git.kernel.org/stable/c/a4f27ad055392fa164f5649e89a3637b033c5fcc"}],"tags":["cve.org"],"epss":0.00643,"epssPercentile":0.49771,"ingestedAt":"2026-10-16T19:46:24.410Z","slug":"CVE-2026-72310","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix overflow in passthrough ioctl bounds check\n\nsmb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload\nbefore copying it to userspace.\n\nThe payload offset and length both come from 32-bit fields. The bounds\ncheck currently adds OutputOffset and qi.input_buffer_length directly, so\nthe addition can wrap in 32-bit arithmetic before the result is compared\nagainst the response buffer length.\n\nA malicious server can use a large OutputOffset and a small OutputCount\nto make the wrapped sum pass the bounds check. The later copy_to_user()\nthen reads from io_rsp + OutputOffset, outside the response buffer.\n\nUse size_add() for the offset plus length check so overflow is treated as\nout of bounds.\n\n## Affected\n\n- `Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 175357ee0c596cb82054650dfa32fda51ad35aaa`\n- `Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < dbd126539c098dba3159ce7d34b10b2daddcbd0f`\n- `Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 63feb687e89a3a52a31e6e01764117cc500f1974`\n- `Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 160045fc943f6c46b227644261252c8a22b8a87a`\n- `Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < b30771b69eafae750afb7385fbcc3d77ed3f3670`\n- `Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 1627e7d5c9b09721a141d07cedb178882f1ded67`\n- `Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 1a638c55f2db6cb2296e5e3138015dd8fd9d4aa9`\n- `Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < a4f27ad055392fa164f5649e89a3637b033c5fcc`\n- `Linux 2005c32ec99ee2490e8131b3953f3f212009ffea`\n- `Linux >= 5.4.69 < 5.5`\n- `Linux 5.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}