Skip to content
Sign in
7.6 High

CVE-2026-43350 In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before…

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS mode SID and reads sid.sub_auth[2] to recover the mode bits. That assumes the ACE carries three subauthorities, but compare_sids() only compares min(a, b) subauthorities. A malicious server can return an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still matches sid_unix_NFS_mode and then drives the sub_auth[2] read four bytes past the end of the ACE. Require num_subauth >= 3 before treating the ACE as an NFS mode SID. This keeps the fix local to the special-SID mode path without changing compare_sids() semantics for the rest of cifsacl.

Affected products and versions

Product Affected versions Fixed in
Linux 7.1 earliest → < 7.1 7.1
Linux 7.0 earliest → < 7.0.2 7.0.2
Linux 6.18 earliest → < 6.18.25 6.18.25
Linux 6.12 earliest → < 6.12.84 6.12.84
Linux 6.6 earliest → < 6.6.136 6.6.136
Linux 6.1 earliest → < 6.1.175 6.1.175
Linux 5.15 earliest → < 5.15.210 5.15.210
Linux 5.10 earliest → < 5.10.259 5.10.259
Linux 5.4 No fix stated
Show the other branch
Product Affected versions Fixed in
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Versions not published

Other CVEs of Linux

The 18286 CVEs of Linux →
CVE-2026-100081 xen-netback: defer xenvif_mcast_addr_list_free() Not rated CVE-2026-100082 xen-blkback: Avoid UAF when reading I/O statistics Not rated CVE-2026-100080 xen-netback: Fix UAF when reading statistics data Not rated CVE-2026-99270 tcp: Fix potential UAF in reqsk_timer_handler(). 8.1 High
Track this CVE