Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-98405 Details

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual length of the received iov (iov_len). If a server provides an inflated out_len, sidsbuf_end will point past the end of the iov. This defeats the bounds guards in posix_info_sid_size(), allowing out-of-bounds reads into adjacent kernel memory. Fix this by rejecting responses where the calculated sidsbuf_end would exceed the received iov boundaries or cause pointer wraparound.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: kernel.orgCVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://git.kernel.org/stable/c/2f8ed71aaaba3bc8b19cd9930cc62e63e142b299 kernel.org
https://git.kernel.org/stable/c/b09d092eb24ad0110f16a9b7c1ed5d2a0c1733dc kernel.org
https://git.kernel.org/stable/c/b862996e5105be1293da9cdc85da77b76021c3bd kernel.org
https://git.kernel.org/stable/c/d91b9a3b2b38e5ac1b51e9e5b23fe53ad7b49644 kernel.org
https://git.kernel.org/stable/c/eac6917a42899aad0617bbf04798c5dd946a1fe5 kernel.org

Weakness Enumeration

No weakness enumeration is available for this CVE.

Affected Products

No affected product data is available for this CVE.

Change History

4 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-98405
NVD Published Date:
Oct 14, 2026
NVD Last Modified:
Oct 24, 2026
Source:
kernel.org
CVE-2026-98405 Details - Not Deferred