CVE-2026-43185 PUBLISHED

ksmbd: fix signededness bug in smb_direct_prepare_negotiation()

Assigner: Linux
Reserved: 01.05.2026 Published: 06.05.2026 Updated: 06.05.2026

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix signededness bug in smb_direct_prepare_negotiation()

smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message.

By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow.

This fix replaces min_t(int, ...) with min_t(u32)

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 0626e6641f6b467447c81dd7678a69c66f7746cf to ceae058eb707ddd0d68f0872f9d9f23b7c30c37b (excl.)
  • affected from 0626e6641f6b467447c81dd7678a69c66f7746cf to 55abc475d096da4a5356b6efb0cfdc6156bc1550 (excl.)
  • affected from 0626e6641f6b467447c81dd7678a69c66f7746cf to 6b4f875aac344cdd52a1f34cc70ed2f874a65757 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.15 is affected
  • unaffected from 0 to 5.15 (excl.)
  • unaffected from 6.18.16 to 6.18.* (incl.)
  • unaffected from 6.19.6 to 6.19.* (incl.)
  • unaffected from 7.0 to * (incl.)

References