Executive brief
The Linux kernel's SMB client implementation contains a logic error when processing network responses from SMB servers. When a server sends a malformed response with insufficient data, the code reads memory beyond the received buffer before validating the buffer size, potentially exposing sensitive kernel memory or causing a system crash. This affects any system using the SMB client to connect to file servers or network shares.
Technical details
A use-before-check vulnerability exists in reparse_buf_ptr() within fs/smb/client/smb2inode.c. The function reads buf->ReparseDataLength (a 16-bit value at offset 4-5 in the reparse_data_buffer structure) before verifying that the received data buffer is large enough to safely contain this field. If an SMB server returns OutputCount less than 6 bytes, the read at offset 4-5 accesses data beyond the bounds of the received buffer. The vulnerability is triggered during SMB reparse point handling, which is part of SMB2/SMB3 protocol operations. An attacker controlling a malicious SMB server can craft a response that triggers the out-of-bounds read, leading to information disclosure or denial of service. The fix reorders the checks to validate count >= sizeof(*buf) before dereferencing ReparseDataLength.
Affected products
- Linux Linux kernel Affected versions include 5.13+ through at least 6.9; patched in stable branches as of late 2026
Timeline
- 2026-09-11: disclosed: Published in NVD
- 2026-08-24: patched: Upstream fix commit 05f78e6cf34ea3a285053bd5999e08e8ac298bd5
- 2026-09-07: patched: Included in stable releases