CVE-2026-43112 fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
An out-of-bounds read in the Linux kernel SMB client allows attackers to cause a system crash via crafted path inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-43112?
CVE-2026-43112 is a high-severity memory corruption vulnerability in Linux kernel, published on 6 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read.
This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL.
The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.
Weakness: CWE-125
Which versions are affected by CVE-2026-43112?
It affects 1 product.
Linux distribution packages (40)
bpftool AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-abi-stablelists AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-core AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-cross-headers AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-debug AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-debug-core AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-debug-devel AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-debug-modules AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-debug-modules-extra AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-devel AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-doc AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-headers AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-modules AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-modules-extra AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-rt AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-rt-core AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-rt-debug AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-rt-debug-core AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-rt-debug-devel AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-rt-debug-modules AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-rt-debug-modules-extra AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-rt-devel AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-rt-modules AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-rt-modules-extra AlmaLinux:8 | All versions | 4.18.0-553.141.1.rt7.482.el8_10 |
kernel-tools AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-tools-libs AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-tools-libs-devel AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-zfcpdump AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-zfcpdump-core AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-zfcpdump-devel AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-zfcpdump-modules AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
kernel-zfcpdump-modules-extra AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
perf AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
python3-perf AlmaLinux:8 | All versions | 4.18.0-553.141.1.el8_10 |
bpftool Red Hat:enterprise_linux:8::baseos | All versions | 0:4.18.0-553.141.1.el8_10 |
bpftool-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:4.18.0-553.141.1.el8_10 |
kernel Red Hat:enterprise_linux:8::baseos | All versions | 0:4.18.0-553.141.1.el8_10 |
kernel-abi-stablelists Red Hat:enterprise_linux:8::baseos | All versions | 0:4.18.0-553.141.1.el8_10 |
kernel-core Red Hat:enterprise_linux:8::baseos | All versions | 0:4.18.0-553.141.1.el8_10 |
Products include Linux kernel.
How do I fix CVE-2026-43112?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43112 being exploited?
There is no known exploitation of CVE-2026-43112 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as ALSA-2026:36365, ALSA-2026:36366, BELL-CVE-2026-43112, DEBIAN-CVE-2026-43112, GHSA-24h4-22f3-65qc, RHSA-2026:36365 and 10 more.