CVE-2026-98168
smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
No known exploitation. EPSS puts it in the 9th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 48ca7139ab7f0bbed95ff7a901ea497017769657, < 3d67f155fe5813cfb02a551a9a12d6ea06a902e9Upgrade to: 3d67f155fe5813cfb02a551a9a12d6ea06a902e9Affected: ≥ 56e84c64fc257a95728ee73165456b025c48d408, < d1152c96a3002e3df6b9a5b007cecaa7b19b4f79Upgrade to: d1152c96a3002e3df6b9a5b007cecaa7b19b4f79Affected: ≥ 56e84c64fc257a95728ee73165456b025c48d408, < 8dc5db3a0e583ea8d31d0613cefd99e93e095c3cUpgrade to: 8dc5db3a0e583ea8d31d0613cefd99e93e095c3cAffected: ≥ 56e84c64fc257a95728ee73165456b025c48d408, < 5f0306e731e2f46e91419eae57eee3a241c055e0Upgrade to: 5f0306e731e2f46e91419eae57eee3a241c055e0 + 5 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 9th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/3d67f155fe5813cfb02a551a9a12d6ea06a902e9
- git.kernel.org/stable/c/5f0306e731e2f46e91419eae57eee3a241c055e0
- git.kernel.org/stable/c/8dc5db3a0e583ea8d31d0613cefd99e93e095c3c
And 1 more reference. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI