CVE-2026-68343

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System (DFS) referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds read during DFS path parsing. This vulnerability may result in information disclosure or a denial of service.

This vulnerability is rated Moderate rather than Important because successful exploitation requires an established connection to a malicious or compromised file server handling DFS referrals. In typical Red Hat Enterprise Linux deployments, SMB shares are not mounted automatically, requiring administrative action or explicitly configured automation to initiate sessions with external endpoints. Consequently, an unauthenticated remote attacker cannot trigger the flaw unless an affected host actively requests and processes referral metadata from an attacker-controlled endpoint.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.