CVE-2026-72318
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the Linux kernel, the cifs module has a vulnerability due to lack of validation of string offsets in DFS responses. A malicious server can provide offsets pointing outside the response buffer, leading to out-of-bounds memory read during path name processing.
Risk Assessment
An attacker could exploit this vulnerability to read kernel memory, potentially leading to disclosure of sensitive information or privilege escalation.
Recommendation
Apply the Linux kernel update that validates string offsets in DFS responses. Limit trust in CIFS/SMB servers until the update is applied.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets are used to compute the DfsPath and NetworkAddress string pointers without checking whether they still point inside the response buffer. A malformed referral can therefore make the computed pointer exceed the end of the buffer. The resulting negative max_len is then passed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it to kstrndup() as a size_t, allowing strnlen() to read out of bounds. Validate each string offset before deriving the string pointer.