Home

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message. By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow. This fix replaces min_t(int, ...) with min_t(u32)

PUBLISHED Reserved 2026-05-01 | Published 2026-05-06 | Updated 2026-05-08 | Assigner Linux




CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Product status

Default status
unaffected

0626e6641f6b467447c81dd7678a69c66f7746cf (git) before ceae058eb707ddd0d68f0872f9d9f23b7c30c37b
affected

0626e6641f6b467447c81dd7678a69c66f7746cf (git) before 55abc475d096da4a5356b6efb0cfdc6156bc1550
affected

0626e6641f6b467447c81dd7678a69c66f7746cf (git) before 6b4f875aac344cdd52a1f34cc70ed2f874a65757
affected

Default status
affected

5.15
affected

Any version before 5.15
unaffected

6.18.16 (semver)
unaffected

6.19.6 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b

git.kernel.org/...c/55abc475d096da4a5356b6efb0cfdc6156bc1550

git.kernel.org/...c/6b4f875aac344cdd52a1f34cc70ed2f874a65757

cve.org (CVE-2026-43185)

nvd.nist.gov (CVE-2026-43185)

Download JSON