CVE-2026-98168 smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
A malicious SMB server can trigger out-of-bounds reads in the Linux kernel CIFS client, potentially causing a crash or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98168?
CVE-2026-98168 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure.
If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds.
Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.
Which versions are affected by CVE-2026-98168?
How do I fix CVE-2026-98168?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98168 being exploited?
There is no known exploitation of CVE-2026-98168 in the wild and no public exploit code.
Sources
Also known as AZL-106338, BELL-CVE-2026-98168, DEBIAN-CVE-2026-98168, GHSA-p97w-7qmq-228w, UBUNTU-CVE-2026-98168.