In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2_parse_contexts()… (CVE-2026-98454)

The Linux kernel SMB client had a vulnerability in smb2_parse_contexts() where the function validated the entire create-context area but did not limit each individual record to its Next field before dispatching. This allowed malformed chains to expose bytes beyond the current context to handlers. The QFid handler improperly cast the full response structure but only read the DiskFileId field. Similarly, SMB2/SMB3 lease parsers assumed fixed offsets for LeaseState and LeaseFlags rather than using the DataOffset field, potentially reading unrelated in-bounds data. The patch limits each context to its Next value, rejects offsets before the context header, rejects malformed chains, bounds the name range by the current context, avoids dispatching handlers when DataLength is zero, reads DiskFileId only when covered by context data, and parses lease contexts strictly by DataOffset and expected size, skipping lease parsing on size mismatch without failing the open.

This vulnerability could lead to out-of-bounds reads within the SMB client create context parsing, potentially exposing unintended kernel memory contents to the SMB client handlers. While no direct exploit or active exploitation is reported, such memory exposure could aid attackers in information disclosure or further exploitation chains.

A fix has been implemented in the Linux kernel to address this vulnerability by enforcing strict bounds checking and rejecting malformed create-context chains. Users should apply the official Linux kernel updates that include this patch. No additional mitigation steps are indicated beyond applying the fix.