CVE-2026-98170

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()

In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is

insufficient. It allows iteration to continue even if the remaining

src_size is too small to contain a complete smb2_ea_info structure.

Consequently, reads of ea_name_length and ea_value_length can occur

out-of-bounds.

Fix this by ensuring src_size >= sizeof(*src) before attempting to read

any structure fields. Additionally, reject any next_entry_offset that is

smaller than sizeof(*src) or that would advance the pointer beyond the

available buffer.

Note that for calls where the server returns a malformed EA list, the

error returned to userspace changes from -ENODATA (getxattr) or

-ERANGE (listxattr) to -EIO. This correctly signals a server protocol

error rather than misleadingly indicating "attribute not present" or

"output buffer too small".