Junglewise Threat Intelligence

CVE-2026-52967: Linux Kernel infinite loop and OOB read in SMB client symlink handling

CVE-2026-52967 · Severity: info · CVSS 0 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's SMB client could allow a malicious or compromised server to trigger an infinite loop or an out-of-bounds memory read on 32-bit systems. This component is responsible for connecting to network file shares. An exploit could lead to a system hang (denial of service) or potentially expose sensitive kernel memory, impacting the stability and security of the affected device.

Technical details

A vulnerability exists in the 'symlink_data()' function within 'fs/smb/client/smb2file.c' of the Linux kernel. On 32-bit architectures, improper validation of the 'ErrorDataLength' field in SMB2 error context responses can cause integer wrapping during pointer arithmetic. Specifically, certain large values for 'ErrorDataLength' can result in a 'next' pointer that either points back to the current structure (causing an infinite loop) or points before the current structure (causing an out-of-bounds read). This can be triggered by a malicious SMB server sending crafted error responses to a client. The fix introduces a bounds check to ensure the length does not exceed the available buffer space.

Affected products

  • Linux Linux Kernel 6.1 to 6.1.175, 6.6 to 6.6.141, 6.12 to 6.12.91, 6.18 to 6.18.33, 7.0 to 7.0.10

Timeline

  • 2026-05-14: patched: Initial fix committed to mainline kernel
  • 2026-06-24: disclosed: CVE published

References

Related threats