Out-of-bounds read in Linux kernel - CVE-2026-98168

Vulnerability details

The vulnerability allows a remote attacker to trigger out-of-bounds reads.

The vulnerability exists due to insufficient bounds checking in cifs_query_reparse_point() when processing an SMB server response containing reparse point data. A remote attacker can send a crafted response with a DataOffset that leaves fewer than eight bytes available for the reparse_data_buffer header to trigger out-of-bounds reads.

The affected reads access the ReparseTag and ReparseDataLength fields.

Affected software

How to mitigate CVE-2026-98168

External References

• https://git.kernel.org/stable/c/3d67f155fe5813cfb02a551a9a12d6ea06a902e9
• https://git.kernel.org/stable/c/5f0306e731e2f46e91419eae57eee3a241c055e0
• https://git.kernel.org/stable/c/8dc5db3a0e583ea8d31d0613cefd99e93e095c3c
• https://git.kernel.org/stable/c/d1152c96a3002e3df6b9a5b007cecaa7b19b4f79

Related Security Bulletins

• Out-of-bounds read in Linux kernel smb client
• Debian update for linux