CVE-2026-72318

A flaw was found in the Linux kernel's CIFS component. A remote attacker could exploit this vulnerability by providing a specially crafted Distributed File System (DFS) referral. The system fails to properly validate string offsets within these referrals, which can lead to an out-of-bounds read. This could result in information disclosure or a denial of service.

Red Hat has evaluated this vulnerability as having an Important severity rating because an attacker controlling a malicious or compromised SMB server can induce client-side kernel crashes or leak sensitive system memory over the network. Exploitation is contingent upon an affected host initiating a CIFS/SMB mount or following Distributed File System referrals to the untrusted server. Systems that do not mount untrusted remote SMB shares or do not load the CIFS filesystem kernel module are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the CIFS kernel module from loading if SMB/CIFS network file shares are not required:

1. Blacklist the cifs kernel module by creating a modprobe configuration file:

echo "install cifs /bin/true" >> /etc/modprobe.d/disable-cifs.conf

2. If the module is currently loaded, unmount all active CIFS mounts and unload the module:

modprobe -r cifs

Caveats: Disabling the cifs module prevents the system from mounting SMB and CIFS network file systems. If active shares cannot be unmounted or the module cannot be unloaded immediately, a system reboot will be required to apply the change.