CVE-2026-52967

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel SMB Client

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix possible infinite loop and oob read in symlink_data() On 32-bit architectures, the infinite loop is as follows: len = p->ErrorDataLength == 0xfffffff8 u8 *next = p->ErrorContextData + len next == p On 32-bit architectures, the out-of-bounds read is as follows: len = p->ErrorDataLength == 0xfffffff0 u8 *next = p->ErrorContextData + len next == (u8 *)p - 8

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52967

EUVD

EUVD-2026-38835

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 6.0.16 (inc) to 6.1.175 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's SMB client code, specifically in the function symlink_data(). It involves a possible infinite loop and an out-of-bounds (OOB) read on 32-bit architectures.

The infinite loop occurs when the length value (ErrorDataLength) is set to 0xfffffff8, causing a pointer calculation that results in the pointer 'next' pointing back to the same structure 'p', creating a loop.

The out-of-bounds read happens when ErrorDataLength is 0xfffffff0, causing the pointer 'next' to point to memory 8 bytes before the structure 'p', which is outside the valid bounds.

Impact Analysis

This vulnerability can cause the Linux kernel SMB client to enter an infinite loop or read memory outside of its intended bounds on 32-bit systems.

An infinite loop could lead to a denial of service by consuming CPU resources indefinitely.

An out-of-bounds read could potentially expose sensitive memory contents or cause system instability or crashes.

Hi! I’m here to help you understand CVE-2026-52967. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70