CVE-2026-97565

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject short READ responses in CIFSSMBRead()

CIFSSMBRead() reads DataLengthHigh, DataLength and DataOffset out of

the READ_RSP returned by the server without first checking that a

whole READ_RSP was actually received. The length of the response is

recorded in rsp_iov.iov_len, but nothing constrains it to be at least

read_rsp_size before those fields are dereferenced.

A malicious or compromised SMB1 server can return a response shorter

than the READ_RSP header, so that parsing the header itself reads past

the end of the receive buffer. SMB1 is not negotiated by default;

reaching this code requires an explicit vers=1.0 mount.

Reject the response unless it is at least read_rsp_size bytes long.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References