{"id":"CVE-2024-26828","title":"cifs: fix underflow in parse_server_interfaces()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix underflow in parse_server_interfaces()\n\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum siz…","severity":"critical","cvss":9.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < 3babdcb5f1809a9a41e31547a063dedf6bb44cca","Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < 7190353835b4a219abb70f90b06cdcae97f11512","Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < f7ff1c89fb6e9610d2b01c1821727729e6609308","Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < df2af9fdbc4ddde18a3371c4ca1a86596e8be301","Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < cffe487026be13eaf37ea28b783d9638ab147204","Linux 4.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-06-12T17:36:16.490979Z"},"published":"2024-04-17","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:17:52.665Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-26828","references":[{"url":"https://git.kernel.org/stable/c/3babdcb5f1809a9a41e31547a063dedf6bb44cca"},{"url":"https://git.kernel.org/stable/c/7190353835b4a219abb70f90b06cdcae97f11512"},{"url":"https://git.kernel.org/stable/c/f7ff1c89fb6e9610d2b01c1821727729e6609308"},{"url":"https://git.kernel.org/stable/c/df2af9fdbc4ddde18a3371c4ca1a86596e8be301"},{"url":"https://git.kernel.org/stable/c/cffe487026be13eaf37ea28b783d9638ab147204"}],"tags":["cve.org"],"epss":0.00754,"epssPercentile":0.55374,"ingestedAt":"2026-11-03T12:44:28.795Z","slug":"CVE-2024-26828","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix underflow in parse_server_interfaces()\n\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum size we need.  However,\nthe problem is that \"bytes_left\" is type ssize_t while sizeof() is type\nsize_t.  That means that because of type promotion, the comparison is\ndone as an unsigned and if we have negative bytes left the loop\ncontinues instead of ending.\n\n## Affected\n\n- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < 3babdcb5f1809a9a41e31547a063dedf6bb44cca`\n- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < 7190353835b4a219abb70f90b06cdcae97f11512`\n- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < f7ff1c89fb6e9610d2b01c1821727729e6609308`\n- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < df2af9fdbc4ddde18a3371c4ca1a86596e8be301`\n- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < cffe487026be13eaf37ea28b783d9638ab147204`\n- `Linux 4.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":51.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}