Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98168

smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 848d78e3625f15de09d34a562dc49a98b78a62f3 to < aa00eead258e4fe8158a3a3e2d65facf06274abdaffected
  • 48ca7139ab7f0bbed95ff7a901ea497017769657 to < 3d67f155fe5813cfb02a551a9a12d6ea06a902e9affected
  • 56e84c64fc257a95728ee73165456b025c48d408 to < d1152c96a3002e3df6b9a5b007cecaa7b19b4f79affected
  • 56e84c64fc257a95728ee73165456b025c48d408 to < 8dc5db3a0e583ea8d31d0613cefd99e93e095c3caffected
  • 56e84c64fc257a95728ee73165456b025c48d408 to < 5f0306e731e2f46e91419eae57eee3a241c055e0affected
  • c13b779d26b3702fba8f7d5fe757aba5bda85fd0affected
  • 6.6.94 to < 6.6.160affected
  • 6.12.34 to < 6.12.112affected
  • 6.15.3 to < 6.16affected

Linux Linux

Default version status: affected

  • 6.16affected
  • 0 to < 6.16unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.54 to ≤ 6.18.*unaffected
  • 7.2.8 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References