SB20261007194 - Out-of-bounds read in Linux kernel smb client

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-98168)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads.

The vulnerability exists due to insufficient bounds checking in cifs_query_reparse_point() when processing an SMB server response containing reparse point data. A remote attacker can send a crafted response with a DataOffset that leaves fewer than eight bytes available for the reparse_data_buffer header to trigger out-of-bounds reads.

The affected reads access the ReparseTag and ReparseDataLength fields.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3d67f155fe5813cfb02a551a9a12d6ea06a902e9
• https://git.kernel.org/stable/c/5f0306e731e2f46e91419eae57eee3a241c055e0
• https://git.kernel.org/stable/c/8dc5db3a0e583ea8d31d0613cefd99e93e095c3c
• https://git.kernel.org/stable/c/d1152c96a3002e3df6b9a5b007cecaa7b19b4f79