CVE-2026-68343
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, the SMB client's parse_dfs_referrals() did not validate the PathConsumed value in DFS responses. A malicious response with an oversized PathConsumed can cause subsequent DFS path parsing to advance beyond the end of the path.
Risk Assessment
An attacker could exploit this to cause incorrect behavior or potential data integrity issues on systems using SMB.
Recommendation
Apply the Linux kernel update that validates PathConsumed against the search name length.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing. If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path. Validate PathConsumed against the search name length before storing it in the parsed referral.