CVE-2026-98168smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 48ca7139ab7f0bbed95ff7a901ea497017769657 builds before 3d67f155fe5813cfb02a551a9a12d6ea06a902e9; from 56e84c64fc257a95728ee73165456b025c48d408 before d1152c96a3002e3df6b9a5b007cecaa7b19b4f79; 56e84c64fc257a95728ee73165456b025c48d408 builds before 8dc5db3a0e583ea8d31d0613cefd99e93e095c3c; 56e84c64fc257a95728ee73165456b025c48d408 builds before 5f0306e731e2f46e91419eae57eee3a241c055e0; 848d78e3625f15de09d34a562dc49a98b78a62f3; c13b779d26b3702fba8f7d5fe757aba5bda85fd0; from 6.12.34 before 6.12.112; from 6.6.94 before 6.7; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/3d67f155fe5813cfb02a551a9a12d6ea06a902e9
- https://git.kernel.org/stable/c/d1152c96a3002e3df6b9a5b007cecaa7b19b4f79
- https://git.kernel.org/stable/c/8dc5db3a0e583ea8d31d0613cefd99e93e095c3c
- https://git.kernel.org/stable/c/5f0306e731e2f46e91419eae57eee3a241c055e0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.