CVE-2026-98171High· 8.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score49/ 100 · Moderate

impact 48.4 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 6, 2026

Updated

Oct 7, 2026

CVSS

8.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

49 · Moderate

EPSS

0.51% · p44

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Oct 7.

0.2% → 0.5%▲ 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 20 days

Oct 6, 2026Published
Disclosed via NVD
Oct 7, 2026Record revised
Last analysed / modified upstream
Oct 7, 2026EPSS first tracked
0.2%
Oct 7, 2026CVSS changed
— → 8.8
Oct 7, 2026Severity changed
none → high
Oct 26, 2026EPSS peak
0.2% → 0.5%

Linux #nvd #cve.org

Affected

Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 72eaef1f37a3b6bec11c342736834dc3707be3e4
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 491e33144dee872cffda207f6fcb09260728f803
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 8749946579708ea0d339034bb7f423a67dbe89cf
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 96c436e4b010711452b2872558938f4ef276492a
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 858d5ac22cb889266993e7670f9f0c4f4aeedd78
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 05762c5bc1cfdcac36747994fde2c04387a457f1
Linux 4.19

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames:

Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths.
Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue.
Reject next_cmd values smaller than MID_HEADER_SIZE(server).
Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Oct 7, 2026CVSS — → 8.8
Oct 7, 2026Severity none → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

← Back to feed

CVE-2026-98171High· 8.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score49/ 100 · Moderate

impact 48.4 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 6, 2026

Updated

Oct 7, 2026

CVSS

8.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

49 · Moderate

EPSS

0.51% · p44

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Oct 7.

0.2% → 0.5%▲ 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

6 events · 20 days

Oct 6, 2026Published
Disclosed via NVD
Oct 7, 2026Record revised
Last analysed / modified upstream
Oct 7, 2026EPSS first tracked
0.2%
Oct 7, 2026CVSS changed
— → 8.8
Oct 7, 2026Severity changed
none → high
Oct 26, 2026EPSS peak
0.2% → 0.5%

Linux #nvd #cve.org

Affected

Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 72eaef1f37a3b6bec11c342736834dc3707be3e4
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 491e33144dee872cffda207f6fcb09260728f803
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 8749946579708ea0d339034bb7f423a67dbe89cf
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 96c436e4b010711452b2872558938f4ef276492a
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 858d5ac22cb889266993e7670f9f0c4f4aeedd78
Linux >= b24df3e30cbf48255db866720fb71f14bf9d2f39 < 05762c5bc1cfdcac36747994fde2c04387a457f1
Linux 4.19

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames:

Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths.
Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue.
Reject next_cmd values smaller than MID_HEADER_SIZE(server).
Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Oct 7, 2026CVSS — → 8.8
Oct 7, 2026Severity none → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org