CVE-2026-99109

Status: UPDATED  |  Advisory ID: CVE-2026-99109

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject SetEA requests that do not fit the request buffer

CIFSSMBSetEA() copies the caller's extended attribute value into the

SMB request buffer without checking that it fits. The requirement is

stated in the source but was never implemented:

/*BB add length check to see if it would fit in

negotiated SMB buffer size BB */

/* if (ea_value_len > buffer_size - 512 (enough for header)) */

if (ea_value_len)

memcpy(parm_data->list.name + name_len + 1,

ea_value, ea_value_len);

The only bound applied on the way in is in cifs_xattr_set():

#define MAX_EA_VALUE_SIZE CIFSMaxBufSize

...

if (size > MAX_EA_VALUE_SIZE)

CIFSMaxBufSize is the full payload capacity of the buffer, so a value

of exactly that size leaves no room for the SMB header, the TRANS2

parameter block, the fealist header and the EA name that are written

ahead of it in the same object.

SendReceive() already enforces the correct limit on this very length:

if (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE)

but it is called after the copy has taken place. An unprivileged

setxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte

value writes 16384 bytes starting 345 bytes into a 16588-byte

cifs_request object, ending 141 bytes past it:

BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0

Write of size 16384 at addr ffff888003aa0159 by task init/68

__asan_memcpy+0x3c/0x60

CIFSSMBSetEA+0xabc/0xde0

cifs_xattr_set+0xd3a/0xff0

__vfs_setxattr+0x13e/0x1a0

The buggy address is located 345 bytes inside of

allocated 16588-byte region

Apply SendReceive()'s limit to the assembled request before the copy

rather than after it, and widen the byte counters so the sum cannot

wrap before it is tested.

byte_count is also tested against U16_MAX, because it is stored in the

16-bit pSMB->ByteCount. That becomes reachable when CIFSMaxBufSize is

raised at module load, where it may be set as high as 1024*127: with a

5-byte EA name and a 65521-byte value, count is exactly U16_MAX while

byte_count is 65556, and cpu_to_le16() would truncate it to 20 and

transmit a frame whose ByteCount does not match its length. Testing

byte_count covers count as well, since byte_count is the larger of the

two and count's only 16-bit consumer is written after this point.

check_add_overflow() is evaluated first so that total_len is assigned

before it is reported. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References