---
id: CVE-2026-98454
title: 'smb: client: fix create context out-of-bounds reads'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  smb: client: fix create context out-of-bounds reads

  smb2_parse_contexts() validates the complete create-context area but
  does not limit each record to its Next field b…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d <
    e4c49012708c917eafd9c27054b02d0f8b30fe64
  - >-
    Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d <
    28bc9a871799363afa3139e961a8e3684feb8704
  - >-
    Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d <
    05a7fd80024ff32b9b40ab1478bb172eeab1c386
  - >-
    Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d <
    cecc5399987e73a528ce2b662eeb54af69163cbd
  - >-
    Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d <
    67f4c1c6a1b51e203d986779299824d1c2c590a6
  - Linux 3.7
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:15:04.139Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98454'
references:
  - url: 'https://git.kernel.org/stable/c/e4c49012708c917eafd9c27054b02d0f8b30fe64'
  - url: 'https://git.kernel.org/stable/c/28bc9a871799363afa3139e961a8e3684feb8704'
  - url: 'https://git.kernel.org/stable/c/05a7fd80024ff32b9b40ab1478bb172eeab1c386'
  - url: 'https://git.kernel.org/stable/c/cecc5399987e73a528ce2b662eeb54af69163cbd'
  - url: 'https://git.kernel.org/stable/c/67f4c1c6a1b51e203d986779299824d1c2c590a6'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.304Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix create context out-of-bounds reads

smb2_parse_contexts() validates the complete create-context area but
does not limit each record to its Next field before dispatching it.  A
malformed chain can therefore expose bytes beyond the current context to
a handler.  The QFid handler also used a full response-structure cast
although it only reads DiskFileId.

The SMB2/SMB3 lease parsers made the same layout assumption: they read
LeaseState and LeaseFlags at canonical offsets rather than at
DataOffset.  A valid non-canonical DataOffset could therefore yield
unrelated in-bounds data, while a short DataLength was still accepted.

Limit each context to its Next value, reject offsets before the context
header, and reject malformed chains.  Bound the name range by the current
context and do not dispatch a known handler when DataLength is zero.  Read
the QFid DiskFileId only when the context data covers that field.  Parse the
lease context from DataOffset and require DataLength to match the v1 or v2
lease_context size used by ksmbd.  A size mismatch skips lease parsing
without failing the open.

## Affected

- `Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d < e4c49012708c917eafd9c27054b02d0f8b30fe64`
- `Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d < 28bc9a871799363afa3139e961a8e3684feb8704`
- `Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d < 05a7fd80024ff32b9b40ab1478bb172eeab1c386`
- `Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d < cecc5399987e73a528ce2b662eeb54af69163cbd`
- `Linux >= b8c32dbb0deb287a5fcb78251e4eae6c7275760d < 67f4c1c6a1b51e203d986779299824d1c2c590a6`
- `Linux 3.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.