SB2026100752 - Out-of-bounds write in Linux kernel smb client

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-98318)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to out-of-bounds writes in the SMB client's create_native_symlink() function when processing absolute symlink targets without the expected NT drive prefix. A local user can create a symlink with a crafted absolute target such as "/ab" to corrupt kernel memory.

Exploitation requires write access to a mounted SMB share. The issue occurs when symlinkroot is unset and POSIX paths are not enabled, including with default settings.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430
• https://git.kernel.org/stable/c/6913ff607c2bc8694193e1fcc40bf16d75f35f16