CVE-2026-97560

A flaw was found in the Linux kernel's SMB (Server Message Block) client. When parsing a share-root relative native symbolic link, an incorrect length calculation causes the client to read past the end of the allocated buffer in the smb2_parse_native_symlink function. A malicious server or attacker providing crafted SMB responses can exploit this issue to trigger a Denial of Service (DoS) via a kernel crash or potentially expose sensitive kernel memory.

A moderate impact flaw was found in the Linux kernel SMB client (fs/smb/client/reparse.c) in smb2_parse_native_symlink(). When parsing a share-root relative native symlink, the code copies from smb_target+1 to skip the leading separator but uses strlen(smb_target)+1 as the length, reading one byte past the allocated buffer. A malicious or compromised SMB server can supply a crafted symlink target (reparse point); when a local user or workload then accesses such a symlink on a mounted SMB share (for example via a stat or path lookup), the out-of-bounds read is triggered, which can crash the kernel and cause a denial of service. Only a single byte past the string terminator is read, and the Red Hat assessment found no evidence of information disclosure, so the impact is limited to availability (Red Hat CVSS 3.1: 5.5, MODERATE, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), despite the CVE description mentioning possible exposure of sensitive kernel memory. The vulnerable code was introduced into Red Hat kernels through a backport of the 'cifs: Fix parsing native symlinks relative to the export' change and is present only in newer streams; Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 and 9.4 update streams and their kernel-rt builds, and OpenShift Container Platform 4.12 through 4.18 are not affected because the vulnerable code is not present there. For the affected streams (Red Hat Enterprise Linux 9 versions 9.6 and later, Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.19 and later), the fix is deferred: this one-byte out-of-bounds read has a practical consequence of a local denial of service rather than memory corruption or privilege escalation, so it does not warrant an immediate out-of-cycle update and the fix will be delivered in a future scheduled kernel update. The residual risk is a kernel crash on systems where a user accesses a crafted native symlink on an SMB share served by a malicious server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.