CVE-2026-43185
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
06/05/2026
Last modified:
11/05/2026
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()<br />
<br />
smb_direct_prepare_negotiation() casts an unsigned __u32 value<br />
from sp->max_recv_size and req->preferred_send_size to a signed<br />
int before computing min_t(int, ...). A maliciously provided<br />
preferred_send_size of 0x80000000 will return as smaller than<br />
max_recv_size, and then be used to set the maximum allowed<br />
alowed receive size for the next message.<br />
<br />
By sending a second message with a large value (>1420 bytes)<br />
the attacker can then achieve a heap buffer overflow.<br />
<br />
This fix replaces min_t(int, ...) with min_t(u32)
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.15 (including) | 6.18.16 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.19 (including) | 6.19.6 (excluding) |
| cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page