---
id: CVE-2024-26828
title: 'cifs: fix underflow in parse_server_interfaces()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  cifs: fix underflow in parse_server_interfaces()

  In this loop, we step through the buffer and after each item we check
  if the size_left is greater than the minimum siz…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    3babdcb5f1809a9a41e31547a063dedf6bb44cca
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    7190353835b4a219abb70f90b06cdcae97f11512
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    f7ff1c89fb6e9610d2b01c1821727729e6609308
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    df2af9fdbc4ddde18a3371c4ca1a86596e8be301
  - >-
    Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b <
    cffe487026be13eaf37ea28b783d9638ab147204
  - Linux 4.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-06-12T17:36:16.490979Z'
published: '2024-04-17'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:17:52.665Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-26828'
references:
  - url: 'https://git.kernel.org/stable/c/3babdcb5f1809a9a41e31547a063dedf6bb44cca'
  - url: 'https://git.kernel.org/stable/c/7190353835b4a219abb70f90b06cdcae97f11512'
  - url: 'https://git.kernel.org/stable/c/f7ff1c89fb6e9610d2b01c1821727729e6609308'
  - url: 'https://git.kernel.org/stable/c/df2af9fdbc4ddde18a3371c4ca1a86596e8be301'
  - url: 'https://git.kernel.org/stable/c/cffe487026be13eaf37ea28b783d9638ab147204'
tags:
  - cve.org
epss: 0.00754
epssPercentile: 0.55374
ingestedAt: '2026-11-03T12:44:28.795Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix underflow in parse_server_interfaces()

In this loop, we step through the buffer and after each item we check
if the size_left is greater than the minimum size we need.  However,
the problem is that "bytes_left" is type ssize_t while sizeof() is type
size_t.  That means that because of type promotion, the comparison is
done as an unsigned and if we have negative bytes left the loop
continues instead of ending.

## Affected

- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < 3babdcb5f1809a9a41e31547a063dedf6bb44cca`
- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < 7190353835b4a219abb70f90b06cdcae97f11512`
- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < f7ff1c89fb6e9610d2b01c1821727729e6609308`
- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < df2af9fdbc4ddde18a3371c4ca1a86596e8be301`
- `Linux >= fe856be475f7cf5ffcde57341d175ce9fd09434b < cffe487026be13eaf37ea28b783d9638ab147204`
- `Linux 4.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.