All vulnerabilities
CVE-2026-98168

Linux: smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3d67f155fe5813cfb02a551a9a12d6ea06a902e9Also 8dc5db3a0e583ea8d31d0613cefd99e93e095c3c, 5f0306e731e2f46e91419eae57eee3a241c055e0 and 3 moreCVE List
Published6 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure.

If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds.

Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.

Text from CVE List

Affected versions 16

  • Linuxaffected: 848d78e3625f15de09d34a562dc49a98b78a62f3 before aa00eead258e4fe8158a3a3e2d65facf06274abdCVE List
  • Linuxaffected: 48ca7139ab7f0bbed95ff7a901ea497017769657 before 3d67f155fe5813cfb02a551a9a12d6ea06a902e9CVE List
  • Linuxaffected: 56e84c64fc257a95728ee73165456b025c48d408 before d1152c96a3002e3df6b9a5b007cecaa7b19b4f79CVE List
  • Linuxaffected: 56e84c64fc257a95728ee73165456b025c48d408 before 8dc5db3a0e583ea8d31d0613cefd99e93e095c3cCVE List
  • Linuxaffected: 56e84c64fc257a95728ee73165456b025c48d408 before 5f0306e731e2f46e91419eae57eee3a241c055e0CVE List
  • Linuxaffected: c13b779d26b3702fba8f7d5fe757aba5bda85fd0CVE List
  • Linuxaffected: 6.6.94 before 6.6.160CVE List
  • Linuxaffected: 6.12.34 before 6.12.112CVE List
  • Linuxaffected: 6.15.3 before 6.16CVE List
  • Linuxaffected: 6.16CVE List
  • Linuxunaffected: all versions before 6.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5