Executive brief
A vulnerability in the Linux kernel's SMB client could allow a malicious or compromised server to trigger an infinite loop or an out-of-bounds memory read on 32-bit systems. This component is responsible for connecting to network file shares. An exploit could lead to a system hang (denial of service) or potentially expose sensitive kernel memory, impacting the stability and security of the affected device.
Technical details
A vulnerability exists in the 'symlink_data()' function within 'fs/smb/client/smb2file.c' of the Linux kernel. On 32-bit architectures, improper validation of the 'ErrorDataLength' field in SMB2 error context responses can cause integer wrapping during pointer arithmetic. Specifically, certain large values for 'ErrorDataLength' can result in a 'next' pointer that either points back to the current structure (causing an infinite loop) or points before the current structure (causing an out-of-bounds read). This can be triggered by a malicious SMB server sending crafted error responses to a client. The fix introduces a bounds check to ensure the length does not exceed the available buffer space.
Affected products
- Linux Linux Kernel 6.1 to 6.1.175, 6.6 to 6.6.141, 6.12 to 6.12.91, 6.18 to 6.18.33, 7.0 to 7.0.10
Timeline
- 2026-05-14: patched: Initial fix committed to mainline kernel
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1b9331b16b0ed9414dcf7583d8134bdfeb117aae
- https://git.kernel.org/stable/c/1cfa2d59f669db28d6292d10ff87ca6837c781b0
- https://git.kernel.org/stable/c/7d9a7f1f96cd617ee9e75bb22217c709038e26b8
- https://git.kernel.org/stable/c/97a05b0ae9ea5ec052be2eef0f9cc7ce03501bbb
- https://git.kernel.org/stable/c/b41598bf54b3fe528994e573df6008f8f4d0a4f4
- https://git.kernel.org/stable/c/cd4b9b662f0fb9aa97ee6bf9034eca76fc6cab23