CVE-2026-40170 is a stack buffer overflow vulnerability in the ngtcp2 library, triggered by processing specially crafted large transport parameters during the QUIC handshake when the qlog callback is enabled. This vulnerability can cause denial of service by writing beyond a fixed-size buffer. While the vulnerable code is present in some Red Hat packages, it is not compiled into the NodeJS binaries shipped by Red Hat, thus those are not affected. The vulnerability impacts Samba versions 4.23 and above included in RHEL 9.8+ and RHEL 10.2+, which support SMB over QUIC using ngtcp2. The vulnerability is tracked under CWE-120. Red Hat recommends disabling the qlog callback to mitigate the issue, which may reduce logging capabilities. No known exploits are reported in the wild.

The vulnerability allows a remote attacker to cause a denial of service by triggering a stack buffer overflow during the QUIC handshake when qlog is enabled. This results in application crashes or restarts, impacting availability. There is no reported impact on confidentiality or integrity. The affected functionality is experimental and disabled by default in NodeJS packages shipped by Red Hat, limiting exposure. Samba on certain RHEL versions that support SMB over QUIC is affected, potentially impacting services relying on this protocol.

Red Hat advises disabling the qlog callback in applications using the ngtcp2 library to prevent the vulnerable code path from being exercised. This mitigation may reduce logging and debugging capabilities. Applications linked against ngtcp2 must be restarted after disabling qlog for the change to take effect. NodeJS packages shipped by Red Hat are not affected as QUIC support is disabled by default. For Samba on RHEL 9.8+ and 10.2+, consider disabling SMB over QUIC or applying updates when available. Patch status is not explicitly confirmed in the advisory; check Red Hat's official advisory for updates.