CVE-2026-97565

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject short READ responses in CIFSSMBRead()

CIFSSMBRead() reads DataLengthHigh, DataLength and DataOffset out of

the READ_RSP returned by the server without first checking that a

whole READ_RSP was actually received. The length of the response is

recorded in rsp_iov.iov_len, but nothing constrains it to be at least

read_rsp_size before those fields are dereferenced.

A malicious or compromised SMB1 server can return a response shorter

than the READ_RSP header, so that parsing the header itself reads past

the end of the receive buffer. SMB1 is not negotiated by default;

reaching this code requires an explicit vers=1.0 mount.

Reject the response unless it is at least read_rsp_size bytes long.