CVE-2026-43185

In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix signededness bug in smbdirectpreparenegotiation()  smbdirectpreparenegotiation() casts an unsigned _u32 value from sp->maxrecvsize and req->preferredsendsize to a signed int before computing mint(int, ...). A maliciously provided preferredsendsize of 0x80000000 will return as smaller than maxrecvsize, and then be used to set the maximum allowed alowed receive size for the next message.  By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow.  This fix replaces mint(int, ...) with mint(u32)