CVE-2026-43185Critical· 9.8▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferre…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.7%
0.7% → 0.8%
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message.
By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow.
This fix replaces min_t(int, ...) with min_t(u32)
Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 56eab82fa6fb5ca024b0514e249d40d9b23ee5a7Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < a110dbe928561d440e9e117d17331139a0bedaceLinux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < ceae058eb707ddd0d68f0872f9d9f23b7c30c37bLinux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 55abc475d096da4a5356b6efb0cfdc6156bc1550Linux >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 6b4f875aac344cdd52a1f34cc70ed2f874a65757Linux 5.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets