Critical 9.8Published May 6, 2026

CVE-2026-43185ksmbd: fix signededness bug in smb_direct_prepare_negotiation()

Updated under an hour ago (Oct 29, 2026, 1:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message. By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow. This fix replaces min_t(int, ...) with min_t(u32)

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	0626e6641f6b467447c81dd7678a69c66f7746cf builds before 56eab82fa6fb5ca024b0514e249d40d9b23ee5a7; from 0626e6641f6b467447c81dd7678a69c66f7746cf before a110dbe928561d440e9e117d17331139a0bedace; from 0626e6641f6b467447c81dd7678a69c66f7746cf before ceae058eb707ddd0d68f0872f9d9f23b7c30c37b; 0626e6641f6b467447c81dd7678a69c66f7746cf builds before 55abc475d096da4a5356b6efb0cfdc6156bc1550; 0626e6641f6b467447c81dd7678a69c66f7746cf builds before 6b4f875aac344cdd52a1f34cc70ed2f874a65757	CNA record
linux linux_kernel linux:linux_kernel	from 5.15 before 6.18.16; from 6.19 before 6.19.6; 7.0	NVD

References

References

https://git.kernel.org/stable/c/56eab82fa6fb5ca024b0514e249d40d9b23ee5a7
https://git.kernel.org/stable/c/a110dbe928561d440e9e117d17331139a0bedace
https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b	patch
https://git.kernel.org/stable/c/55abc475d096da4a5356b6efb0cfdc6156bc1550	patch
https://git.kernel.org/stable/c/6b4f875aac344cdd52a1f34cc70ed2f874a65757	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.