{"id":"CVE-2026-72310","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix overflow in passthrough ioctl bounds check\n\nsmb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload\nbefore copying it to userspace.\n\nThe …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix overflow in passthrough ioctl bounds check\n\nsmb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload\nbefore copying it to userspace.\n\nThe …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 175357ee0c596cb82054650dfa32fda51ad35aaa","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < dbd126539c098dba3159ce7d34b10b2daddcbd0f","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 63feb687e89a3a52a31e6e01764117cc500f1974","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 160045fc943f6c46b227644261252c8a22b8a87a","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < b30771b69eafae750afb7385fbcc3d77ed3f3670","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 1627e7d5c9b09721a141d07cedb178882f1ded67","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < 1a638c55f2db6cb2296e5e3138015dd8fd9d4aa9","Linux >= 2b1116bbe898aefdf584838448c6869f69851e0f < a4f27ad055392fa164f5649e89a3637b033c5fcc","Linux 2005c32ec99ee2490e8131b3953f3f212009ffea","Linux >= 5.4.69 < 5.5","Linux 5.5"],"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:17:21.573","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72310","references":[{"url":"https://git.kernel.org/stable/c/160045fc943f6c46b227644261252c8a22b8a87a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1627e7d5c9b09721a141d07cedb178882f1ded67","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/175357ee0c596cb82054650dfa32fda51ad35aaa","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1a638c55f2db6cb2296e5e3138015dd8fd9d4aa9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63feb687e89a3a52a31e6e01764117cc500f1974","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4f27ad055392fa164f5649e89a3637b033c5fcc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b30771b69eafae750afb7385fbcc3d77ed3f3670","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbd126539c098dba3159ce7d34b10b2daddcbd0f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00643,"epssPercentile":0.50629,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T18:46:23.070703Z"},"ingestedAt":"2026-10-16T19:46:24.410Z","slug":"CVE-2026-72310","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix overflow in passthrough ioctl bounds check\n\nsmb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload\nbefore copying it to userspace.\n\nThe payload offset and length both come from 32-bit fields. The bounds\ncheck currently adds OutputOffset and qi.input_buffer_length directly, so\nthe addition can wrap in 32-bit arithmetic before the result is compared\nagainst the response buffer length.\n\nA malicious server can use a large OutputOffset and a small OutputCount\nto make the wrapped sum pass the bounds check. The later copy_to_user()\nthen reads from io_rsp + OutputOffset, outside the response buffer.\n\nUse size_add() for the offset plus length check so overflow is treated as\nout of bounds.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}