Answer in brief
CVE-2026-98454 records a High severity (CVSS 8.1) vulnerability in smb: client: fix create context out-of-bounds reads. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b8c32dbb0deb287a5fcb78251e4eae6c7275760d <e4c49012708c917eafd9c27054b02d0f8b30fe64 || >=b8c32dbb0deb287a5fcb78251e4eae6c7275760d <28bc9a871799363afa3139e961a8e3684feb8704 || >=b8c32dbb0deb287a5fcb78251e4eae6c7275760d <05a7fd80024ff32b9b40ab1478bb172eeab1c386 || >=b8c32dbb0deb287a5fcb78251e4eae6c7275760d <cecc5399987e73a528ce2b662eeb54af69163cbd || >=b8c32dbb0deb287a5fcb78251e4eae6c7275760d <67f4c1c6a1b51e203d986779299824d1c2c590a6 | e4c49012708c917eafd9c27054b02d0f8b30fe64, 28bc9a871799363afa3139e961a8e3684feb8704, 05a7fd80024ff32b9b40ab1478bb172eeab1c386, cecc5399987e73a528ce2b662eeb54af69163cbd, 67f4c1c6a1b51e203d986779299824d1c2c590a6 |
| Linux/Linuxgeneric | 3.7 | Not reported |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts() validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes beyond the current context to a handler. The QFid handler also used a full response-structure cast although it only reads DiskFileId. The SMB2/SMB3 lease parsers made the same layout assumption: they read LeaseState and LeaseFlags at canonical offsets rather than at DataOffset. A valid non-canonical DataOffset could therefore yield unrelated in-bounds data, while a short DataLength was still accepted. Limit each context to its Next value, reject offsets before the context header, and reject malformed chains. Bound the name range by the current context and do not dispatch a known handler when DataLength is zero. Read the QFid DiskFileId only when the context data covers that field. Parse the lease context from DataOffset and require DataLength to match the v1 or v2 lease_context size used by ksmbd. A size mismatch skips lease parsing without failing the open.
Quoted source text, attributed separately from HOL analysis.