CVE-2026-43112

A flaw was found in the Linux kernel's CIFS (Common Internet File System) client. When the cifs_sanitize_prepath function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.

An Important out-of-bounds read flaw in the Linux kernel's CIFS client can lead to a system crash and denial of service. This vulnerability, present in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS 2, can be triggered by processing specially crafted input to the cifs_sanitize_prepath function, potentially disrupting system availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the cifs kernel module from loading if CIFS client functionality is not required. This can be achieved by blacklisting the module.

Create a file named /etc/modprobe.d/blacklist-cifs.conf with the following content:

blacklist cifs

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect.

dracut -f -v
reboot

Disabling the cifs module will prevent the system from mounting CIFS network shares, which may impact functionality relying on this protocol.