Executive brief
A vulnerability in the Linux kernel's SMB client allows a malicious or compromised file server to read sensitive information from the memory of a connected computer. When a user attempts to access a specially crafted symbolic link on a network share, the system may leak internal memory data back to the user or crash. This could lead to the exposure of private data or a system-wide service interruption.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the Linux kernel SMB client (cifs.ko) within the smb2_parse_symlink_response() and symlink_data() functions. When a server returns a STATUS_STOPPED_ON_SYMLINK error, the client fails to properly validate the length of SMB 3.1.1 error contexts and the subsequent symlink header. A malicious server can provide a crafted ErrorDataLength that causes the parser to read past the end of the buffer. This results in heap memory being leaked, UTF-16 decoded, and returned to userspace via the readlink(2) system call. Patches have been released for various stable kernel branches including 6.1.y, 6.18.y, 6.19.y, and 7.0.y.
Affected products
- Linux Linux Kernel 6.1 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-06: patched: Initial patch authored by Greg Kroah-Hartman
- 2026-04-24: disclosed: CVE-2026-31613 published