CVE-2026-43185

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix signededness bug in smb_direct_prepare_negotiation()

smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, …). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message.

By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow.

This fix replaces min_t(int, …) with min_t(u32)

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/230.html
• https://cwe.mitre.org/data/definitions/231.html

References

• https://git.kernel.org/stable/c/55abc475d096da4a5356b6efb0cfdc6156bc1550
• https://git.kernel.org/stable/c/6b4f875aac344cdd52a1f34cc70ed2f874a65757
• https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b