CVE-2026-98170

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is

insufficient. It allows iteration to continue even if the remaining

src_size is too small to contain a complete smb2_ea_info structure.

Consequently, reads of ea_name_length and ea_value_length can occur

out-of-bounds.

Fix this by ensuring src_size >= sizeof(*src) before attempting to read

any structure fields. Additionally, reject any next_entry_offset that is

smaller than sizeof(*src) or that would advance the pointer beyond the

available buffer.

Note that for calls where the server returns a malformed EA list, the

error returned to userspace changes from -ENODATA (getxattr) or

-ERANGE (listxattr) to -EIO. This correctly signals a server protocol

error rather than misleadingly indicating "attribute not present" or

"output buffer too small".

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References