CVE-2026-98168

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98168

EUVD

EUVD-2026-93096

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	48ca7139ab7f0bbed95ff7a901ea497017769657
Linux	Linux	56e84c64fc257a95728ee73165456b025c48d408
Linux	Linux	56e84c64fc257a95728ee73165456b025c48d408
Linux	Linux	56e84c64fc257a95728ee73165456b025c48d408
Linux	Linux	848d78e3625f15de09d34a562dc49a98b78a62f3
Linux	Linux	c13b779d26b3702fba8f7d5fe757aba5bda85fd0
Linux	Linux	6.12.34
Linux	Linux	6.6.94
Linux	Linux	6.15.3
Linux	Linux	6.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a buffer bounds vulnerability in the Linux kernel's SMB client implementation. The issue occurs in the cifs_query_reparse_point() function where a check fails to ensure there is enough space for a fixed 8-byte header structure before accessing its fields. If a server provides an offset leaving less than 8 bytes remaining, out-of-bounds reads of ReparseTag and ReparseDataLength can occur.

Detection Guidance

This vulnerability is specific to the Linux kernel's CIFS client implementation. Detection requires checking if your system is running a vulnerable kernel version. Use uname -a to check the kernel version and compare it against the fixed version. No direct network detection commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to read sensitive kernel memory or cause system instability by triggering out-of-bounds memory access. It primarily affects systems using the CIFS/SMB protocol to connect to file servers.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory safety issue in the CIFS/SMB client component. Compliance impacts would only occur if exploitation led to data breaches or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Apply the kernel patch that fixes the issue in cifs_query_reparse_point(). Update to a kernel version that includes the fix. If immediate patching is not possible, consider disabling the CIFS client module or restricting access to SMB servers until the patch is applied.

Hi! I’m here to help you understand CVE-2026-98168. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70