Vulnerability in linux (CVE-2026-43185)
Summary
vulnerability in linux (CVE-2026-43185). Successful exploitation can lead to full system takeover.
Original description
The description as published by the source.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix signededness bug in smb_direct_prepare_negotiation()
smb_direct_prepare_negotiation() casts an unsigned __u32 value
from sp->max_recv_size and req->preferred_send_size to a signed
int before computing min_t(int, ...). A maliciously provided
preferred_send_size of 0x80000000 will return as smaller than
max_recv_size, and then be used to set the maximum allowed
alowed receive size for the next message.
By sending a second message with a large value (>1420 bytes)
the attacker can then achieve a heap buffer overflow.
This fix replaces min_t(int, ...) with min_t(u32)
Source: NIST National Vulnerability Database NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
A critical bug in the Linux kernel can allow unauthorized manipulation of system data when specific data is supplied. This issue is similar to Heartbleed seen in OpenSSL, which allowed attackers to adversely affect systems. Installing the updated kernel is necessary to fix this vulnerability.
In the Linux kernel, the function smb_direct_prepare_negotiation() mishandles type casting of certain variables, allowing a deliberately crafted preferred_send_size to trigger a heap buffer overflow. An attacker achieves this by sending a second message with a large value (>1420 bytes). The issue is addressed by modifying the type casting. The fix is available through a kernel update, detail which can be found in specific commits on git.kernel.org.
A heap buffer overflow vulnerability in the Linux kernel's smb_direct_prepare_negotiation() function due to improper type casting.
smb_direct_prepare_negotiation() function within the ksmbd of the Linux kernel.
Critical, with a CVSS score of 9.8 indicating high potential impact through remote exploitation without user interaction.
Update the Linux kernel to a version that includes the patch described in the relevant git commits.
No known workaround is specified in the material; updating the kernel is recommended.
Monitor for large messages (>1420 bytes) in ksmbd transactions or utilize updated kernel logs for unusual activity.
Related past incidents Similar incidents extracted from past CVEs
Heartbleed was a similar vulnerability affecting OpenSSL that exposed data in memory due to improper input validation.
A heap-based buffer overflow in Sudo that could allow privilege escalation.
A remote code execution vulnerability in Apache Log4j due to improper input validation.
If this happens at your company Expected impact per business scenario
Compromise of server control through remote code execution without authentication.
Potential exploitation leading to device control or data theft.
Service disruptions or data breaches due to kernel vulnerabilities.
Organizations should urgently update affected Linux kernel versions to mitigate this critical vulnerability.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.依存マニフェストで影響コンポーネントを特定する。
-
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- BellSoft Alpaquita BELL-CVE-2026-43185 linux-lts
- Debian DEBIAN-CVE-2026-43185 linux
- Ubuntu UBUNTU-CVE-2026-43185 linux-hwe-edge
References
- advisory nvd.nist.gov
- advisory github.com
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web github.com