CVE-2026-97565

A flaw was found in the Linux kernel's SMB (Server Message Block) client. When communicating with a malicious or compromised server, the client fails to verify that an incoming read response meets the expected minimum header size before accessing header fields. A malicious server can send a truncated response packet, triggering an out-of-bounds memory read during header parsing. This flaw primarily leads to a system crash, resulting in a Denial of Service (DoS), or potential information disclosure.

A moderate out-of-bounds read flaw was found in the Linux kernel CIFS/SMB client in CIFSSMBRead(). The client reads the DataLengthHigh, DataLength and DataOffset fields of an SMB1 READ response without first verifying that the response is at least as large as the READ_RSP header. A malicious or compromised SMB server can return a truncated response, causing the client to read past the end of the receive buffer, which can crash the kernel (denial of service) or potentially disclose kernel memory. This flaw affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9 and 10, the kernel packages in Red Hat In-Vehicle OS, and the RHEL CoreOS images shipped with OpenShift Container Platform. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those releases. Exploitation requires explicit configuration: SMB1 is not negotiated by default, so the vulnerable path is reached only when a client mounts a share with the legacy vers=1.0 option against a malicious or compromised server. Because of the moderate severity and the non-default configuration needed to reach the vulnerable code, the fix is currently deferred for the affected products and will be addressed in a future update; until then, the residual risk is a kernel crash or potential information disclosure on systems that use vers=1.0 CIFS mounts against untrusted servers. Red Hat rated this flaw Moderate severity with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code path is reachable only through the legacy SMB1 protocol, which the kernel CIFS client does not negotiate by default. Avoid mounting CIFS shares with the vers=1.0 option, including entries in /etc/fstab or autofs maps; rely on the default protocol negotiation or explicitly request a newer dialect such as vers=2.1 or vers=3.0, and remount any existing SMB1 mounts using a newer dialect. Additionally, restricting CIFS mounts to trusted, non-compromised SMB servers reduces exposure to a malicious server returning truncated responses.