CVE-2026-52967 smb/client: fix possible infinite loop and oob read in symlink_data()
An integer overflow in the Linux kernel SMB client allows attackers to cause infinite loops or out-of-bounds reads on 32-bit systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-52967?
CVE-2026-52967 is a high-severity vulnerability in Linux kernel, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix possible infinite loop and oob read in symlink_data()
On 32-bit architectures, the infinite loop is as follows:
len = p->ErrorDataLength == 0xfffffff8 u8 *next = p->ErrorContextData + len next == p
On 32-bit architectures, the out-of-bounds read is as follows:
len = p->ErrorDataLength == 0xfffffff0 u8 *next = p->ErrorContextData + len next == (u8 *)p - 8
Which versions are affected by CVE-2026-52967?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-52967?
Apply the vendor's patch.
Is CVE-2026-52967 being exploited?
There is no known exploitation of CVE-2026-52967 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-52967, DEBIAN-CVE-2026-52967, GHSA-3jxr-5523-52vg, ROOT-OS-DEBIAN-12-CVE-2026-52967, ROOT-OS-UBUNTU-2404-CVE-2026-52967, UBUNTU-CVE-2026-52967.