CVE-2026-98171

8.8 HIGH

Published 2026-10-06 · Updated 2026-10-07

AI risk analysis

Summary: The flaw involves improper bounds checking and pointer lifecycle management in the handling of compound encrypted frames, which could lead to use-after-free and other security issues.
Exploitability: Exploitation requires specific conditions, such as handling compound encrypted frames, and is moderately difficult due to the need for precise timing and context.
Blast radius: If exploited, this vulnerability could allow attackers to execute arbitrary code or cause system crashes, leading to significant damage.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to the Linux kernel version 6.1.19 or later.

kernelencryptionbuffer-overflow

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames: - Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths. - Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject next_cmd values smaller than MID_HEADER_SIZE(server). - Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.