Critical · published April 22, 2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
After this commit (e2b76ab8b5c9 "ksmbd: add support for read compound"),
response buffer management was changed to use dynamic iov array.
In the new design, smb2_calc_max_out_buf_len() expects the second
argument (hdr2_len) to be the offset of ->Buffer field in the
response structure, not a hardcoded magic number.
Fix the remaining call sites to use the correct offsetof() value.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.15.145, < 5.15.203 | 5.15.203 |
| linux/linux_kernel | ≥ 6.1.71, < 6.1.168 | 6.1.168 |
| linux/linux_kernel | ≥ 6.6.1, < 6.6.131 | 6.6.131 |
| linux/linux_kernel | ≥ 6.7, < 6.12.80 | 6.12.80 |
| linux/linux_kernel | ≥ 6.13, < 6.18.21 | 6.18.21 |
| linux/linux_kernel | ≥ 6.19, < 6.19.11 | 6.19.11 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |