Quick answers
- Is CVE-2026-98318 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-98318 being exploited in the wild.
- How severe is CVE-2026-98318?
- Informational severity, published 6 October 2026.
- Which products and versions are affected?
- Linux versions prior to the patch commit 23c240d9509e15f72e4112fc95f0160ab32ec430.
- Is there a fix for CVE-2026-98318?
- A patch was published on 2026-09-11. Until you apply it: Restrict write access to SMB/CIFS mounted shares or disable SMB symlink support until the kernel is patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-98318 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-98318?
- Check whether you run Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict write access to SMB/CIFS mounted shares or disable SMB symlink support until the kernel is patched.
Technical details
The vulnerability occurs in fs/smb/client/reparse.c when an absolute symlink target lacks the expected NT prefix ("\\??\\X:") but the code still applies fixed-offset manipulations and subtracts a prefix length from a 16-bit length variable, causing integer underflow (wrapping to 65534) and subsequent heap-based buffer overflow in memcpy(). An attacker with write access to a mounted CIFS share and default kernel settings can trigger this with symlink paths like "/ab".
Affected products
- Linux Linux versions prior to the patch commit 23c240d9509e15f72e4112fc95f0160ab32ec430
Timeline
- 2026-10-06: disclosed
- 2026-09-11: patched