Executive brief
The Linux kernel's CIFS (Common Internet File System) implementation handles file sharing with Windows and other systems. A flaw in how it processes DFS (Distributed File System) referral responses from servers allows a malicious or compromised server to provide crafted responses that cause the kernel to read memory outside the intended buffer, potentially exposing sensitive data or crashing the system.
Technical details
The vulnerability is an out-of-bounds read in the parse_dfs_referrals() function in fs/smb/client/misc.c. While the function validates that the response header and referral array fit within the received buffer, it fails to validate server-supplied string offsets (DfsPathOffset and NetworkAddressOffset) before using them to compute memory pointers. A malformed referral with an offset pointing beyond the buffer causes a negative max_len value to be computed, which is then passed as a size_t to kstrndup()/strnlen(), permitting out-of-bounds memory reads. The vulnerability requires a network connection to a CIFS server (unauthenticated DFS referral requests are possible). The fix adds validation checks to ensure each string offset stays within bounds before deriving the pointer.
Affected products
- Linux Linux kernel all versions (patched in mainline and stable branches)
Timeline
- 2026-08-15: disclosed: CVE-2026-72318 published
- 2026-07-08: patched: Fix committed by Guangshuo Li, integrated into mainline and stable branches
- 2026-07-24: other: Backported to stable kernel branches by Greg Kroah-Hartman