CVE-2026-98168

A flaw was found in the Linux kernel's Server Message Block (SMB) client. In the reparse point query handling logic, the client fails to properly validate response buffer boundaries before accessing data structures. A malicious or compromised SMB server can exploit this by returning a crafted response with an invalid data offset, triggering an out-of-bounds memory read. This issue can lead to a system crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.

A moderate out-of-bounds read flaw was found in the Linux kernel SMB client as shipped in newer Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams. In cifs_query_reparse_point(), when processing a query reparse point response, the client validates only that the computed start pointer lies within the response buffer; it does not verify that the 8 bytes required for the fixed reparse_data_buffer header remain. A malicious or compromised SMB server can return a crafted response whose DataOffset leaves fewer than 8 bytes remaining, causing the client to read the ReparseTag and ReparseDataLength fields out of bounds. This can crash the kernel, resulting in a denial of service, and may in principle expose out-of-bounds memory contents, although no direct information disclosure is demonstrated. Exploitation requires the client to connect to and query reparse points from an attacker-controlled or compromised SMB server, which is reflected in the Moderate rating (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code was introduced by downstream backports into recent streams only: RHEL 9.8, 9.9, and 9.10, RHEL 10.2, 10.3, and 10.4, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 are affected. Older streams, including RHEL 6, 7, and 8, RHEL 9.2, 9.4, and 9.6, and RHEL 10.0, do not contain the vulnerable code and are not affected. The fix is currently deferred for the affected streams and will be addressed in a future update rather than an immediate erratum; until a fix is released, the residual risk is a kernel crash (denial of service) on systems that mount or access SMB shares from untrusted servers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.