smb CompoundPDU UAF

Vulnerability analysis

When the kernel SMB client processes compound encrypted responses from a server, it continues using the pre-decryption buffer length to validate NextCommand offsets, allowing those offsets to point into stale ciphertext residue instead of the decrypted plaintext. A secondary buffer pointer is also not cleared after being handed off to the server's receive buffer, so on a later error path the stale pointer can be dereferenced after the buffer has already been freed. The bounds check on NextCommand values is further insufficient — it does not reject values too small for a valid header and can suffer an integer overflow in the upper-bound comparison, permitting out-of-bounds access into adjacent memory. The fix updates the length to the decrypted plaintext size immediately after decryption, clears the buffer pointer once it has been assigned, and adds rigorous bounds validation that rejects NextCommand offsets too small for a header or too close to the buffer end. The vulnerable path is reached whenever a client processes encrypted compound responses from an SMB server, so any system that mounts SMB shares from untrusted or potentially compromised servers is exposed; no local privileges are required beyond the ability to initiate or use an existing SMB mount.