PT-2026-37525 · Linux+1 · Linux Kernel+1

CVE-2026-43185

·

Published

2026-05-06

·

Updated

2026-07-28

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description A signedness bug exists in the smb direct prepare negotiation() function. The function casts unsigned u32 values from sp->max recv size and req->preferred send size to signed integers before computing the minimum value. An attacker can provide a preferred send size of 0x80000000, which is interpreted as smaller than max recv size and used to set the maximum allowed receive size for the subsequent message. By sending a second message exceeding 1420 bytes, a heap buffer overflow can be achieved.

Exploit

Fix

Uncontrolled Recursion

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-43185
USN-8545-1
USN-8546-1
USN-8547-1
USN-8547-2
USN-8604-1
USN-8605-1
USN-8606-1
USN-8607-1
USN-8609-1
USN-8619-1

Affected Products

Linuxmint
Linux Kernel