ANT-2026-M8R2AWBV: ksmbd SMB-Direct: pre-auth remote heap overflow via preferred_send_size signedness (min_t(int))

Pre-auth remote: client negotiate with preferred_send_size=0x80000000 passes min_t(int,...) signed comparison against max_recv_size (1364), corrupting max_recv_size; recv buffers (1420-byte slab) are then posted with sge.length=0x80000000 and the next RDMA SEND overflows the slab via skb_copy_bits (KASAN slab-out-of-bounds write). Reachable over SMB-Direct/iWARP port 5445 (CONFIG_SMB_SERVER_SMBDIRECT + RDMA device or CONFIG_RDMA_SIW). Discovered 2026-02-14; reported by Anthropic to security@kernel.org on 2026-02-16 with PoC and patch. Fixed upstream 2026-02-23 by commit 6b4f875aac34 (min_t(int) -> min_t(u32)), authored by the Anthropic reporter; current mainline also floors at SMBDIRECT_MIN_RECEIVE_SIZE (fs/smb/smbdirect/accept.c:406).

Target

Project: linux
Location: fs/smb/server/transport_rdma.c:smb_direct_prepare_negotiation (code now lives in fs/smb/smbdirect/accept.c)
Discovery: static analysis — not yet dynamically reproduced

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. A trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-M8R2AWBV.

---

Reference: ANT-2026-M8R2AWBV
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

{
  "ant_id": "ANT-2026-M8R2AWBV",
  "bug_class": null,
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-29T20:45:54+00:00",
  "description": null,
  "discovered_at": "2026-02-14T00:00:00+00:00",
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "linux",
  "reproduction": null,
  "technical_details": null,
  "title": "nsfd one",
  "vendor_severity": null
}