# CVE-2026-98318: Linux kernel SMB client buffer overflow in symlink handling

Source: https://junglewise.ai/threats/cve-2026-98318-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-98318 · Severity: info · Published 2026-10-06

The Linux kernel's SMB client implementation contains a buffer overflow vulnerability in its symlink path handling when processing certain malformed targets. A user with write access to a mounted SMB share can craft a symlink that causes the kernel to write past buffer boundaries and read 65,000+ bytes into a 24-byte buffer, potentially triggering a kernel crash or code execution.

Technologies: [Linux](https://junglewise.ai/threats/technologies/linux-linux). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-98318 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-98318 being exploited in the wild.

**How severe is CVE-2026-98318?** Informational severity, published 6 October 2026.

**Which products and versions are affected?** Linux versions prior to the patch commit 23c240d9509e15f72e4112fc95f0160ab32ec430.

**Is there a fix for CVE-2026-98318?** A patch was published on 2026-09-11. Until you apply it: Restrict write access to SMB/CIFS mounted shares or disable SMB symlink support until the kernel is patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-98318 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-98318?** Check whether you run Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Restrict write access to SMB/CIFS mounted shares or disable SMB symlink support until the kernel is patched.

## Technical details

The vulnerability occurs in fs/smb/client/reparse.c when an absolute symlink target lacks the expected NT prefix ("\\??\\X:") but the code still applies fixed-offset manipulations and subtracts a prefix length from a 16-bit length variable, causing integer underflow (wrapping to 65534) and subsequent heap-based buffer overflow in memcpy(). An attacker with write access to a mounted CIFS share and default kernel settings can trigger this with symlink paths like "/ab".

## Affected products

- Linux Linux versions prior to the patch commit 23c240d9509e15f72e4112fc95f0160ab32ec430

## Timeline

- 2026-10-06: disclosed
- 2026-09-11: patched

## References

- [https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430](https://git.kernel.org/stable/c/23c240d9509e15f72e4112fc95f0160ab32ec430)
- [https://git.kernel.org/stable/c/6913ff607c2bc8694193e1fcc40bf16d75f35f16](https://git.kernel.org/stable/c/6913ff607c2bc8694193e1fcc40bf16d75f35f16)

## Related threats

- [Linux kernel use-after-free in conntrack helper](https://junglewise.ai/threats/cve-2026-98442-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel nvmet-rdma queue resource leak](https://junglewise.ai/threats/cve-2026-98152-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel denial of service in IPv4 routing table allocation](https://junglewise.ai/threats/cve-2026-97598-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel null pointer dereference in SPI device matching](https://junglewise.ai/threats/cve-2026-93825-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel bcm2835 pinctrl null pointer dereference](https://junglewise.ai/threats/cve-2026-93274-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)