{"cve":"CVE-2024-26828","nvd":{"published":"2024-04-17T10:15:09.300","modified":"2026-10-30T13:17:22.047","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix underflow in parse_server_interfaces()\n\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum size we need.  However,\nthe problem is that \"bytes_left\" is type ssize_t while sizeof() is type\nsize_t.  That means that because of type promotion, the comparison is\ndone as an unsigned and if we have negative bytes left the loop\ncontinues instead of ending.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","score":9.4},"cwes":["CWE-191"],"references":["https://git.kernel.org/stable/c/3babdcb5f1809a9a41e31547a063dedf6bb44cca","https://git.kernel.org/stable/c/7190353835b4a219abb70f90b06cdcae97f11512","https://git.kernel.org/stable/c/cffe487026be13eaf37ea28b783d9638ab147204","https://git.kernel.org/stable/c/df2af9fdbc4ddde18a3371c4ca1a86596e8be301","https://git.kernel.org/stable/c/f7ff1c89fb6e9610d2b01c1821727729e6609308"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-30T13:47:47.119061695+00:00"},"epss":{"cve":"CVE-2024-26828","score":0.00754,"percentile":0.5506,"date":"2026-10-30"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}