{"cve":"CVE-2026-98170","nvd":{"published":"2026-10-06T09:17:58.640","modified":"2026-10-21T13:21:25.037","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()\n\nIn move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is\ninsufficient. It allows iteration to continue even if the remaining\nsrc_size is too small to contain a complete smb2_ea_info structure.\nConsequently, reads of ea_name_length and ea_value_length can occur\nout-of-bounds.\n\nFix this by ensuring src_size >= sizeof(*src) before attempting to read\nany structure fields. Additionally, reject any next_entry_offset that is\nsmaller than sizeof(*src) or that would advance the pointer beyond the\navailable buffer.\n\nNote that for calls where the server returns a malformed EA list, the\nerror returned to userspace changes from -ENODATA (getxattr) or\n-ERANGE (listxattr) to -EIO. This correctly signals a server protocol\nerror rather than misleadingly indicating \"attribute not present\" or\n\"output buffer too small\".","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca","https://git.kernel.org/stable/c/34a3942e787b9c59758115bd65fe1ec89d68c7a4","https://git.kernel.org/stable/c/61812323c037a94e2e7f0db7ee740c34b126bffe","https://git.kernel.org/stable/c/d3546cecbf81d98bf3b472d341f981eb48c04f47","https://git.kernel.org/stable/c/eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-98170","score":0.00206,"percentile":0.10453,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}