CVE-2026-98169

A flaw was found in the Linux kernel's Server Message Block (SMB) client. This issue leads to information disclosure caused by an out-of-bounds memory read during snapshot enumeration. A malicious SMB server can provide an unexpectedly short response, causing the kernel client to read beyond the allocated buffer and leak adjacent kernel memory to local user space.

An out-of-bounds read in the Linux kernel SMB client's snapshot enumeration results in a moderate-impact information disclosure affecting Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the RHEL CoreOS kernels shipped with OpenShift Container Platform. When a local user enumerates snapshots on a mounted SMB share, smb3_enum_snapshots() sets the reply data length to the 12-byte size of struct smb_snapshot_array without validating the actual length of the server's response. Because SMB2_ioctl() allocates the return buffer to exactly the server-supplied output count, a malicious or compromised SMB server (or an attacker able to intercept SMB traffic) can return an abnormally short reply, causing the subsequent copy_to_user() to read past the end of the buffer and disclose a small amount of adjacent kernel slab memory to the calling local user's process. The flaw does not modify memory or cause a crash.

Red Hat rates this flaw Moderate severity, lower than the upstream CVE.org Important rating (CVSS 7.1), because exploitation requires a local user on a system with an SMB share mounted from a rogue server (or whose SMB traffic is intercepted), and the disclosure is limited to a few bytes of adjacent kernel slab memory, which at worst could assist in attempts to defeat kernel address space layout randomization.

RHEL 8, 9, and 10 kernels (including kernel-rt), Red Hat In-Vehicle OS 2 kernels, and the RHEL CoreOS 8/9 kernels shipped in OpenShift Container Platform 4.12 and later are affected, with the fix deferred to a future scheduled update given the moderate severity and limited practical exploitability of the flaw. RHEL 6 and 7 ELS kernel and kernel-rt are not affected because the vulnerable code is not present in those streams. The residual risk of deferral is the small kernel memory disclosure described above, limited to systems where local users can access SMB mounts backed by untrusted servers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Exploitation requires a local user with access to a mounted SMB share whose server returns a truncated snapshot-enumeration reply. As a mitigation, mount SMB shares only from trusted servers, avoid SMB traffic over untrusted networks, and restrict local access to systems with SMB mounts. Beyond these precautions, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability; the fix will be delivered in a future kernel update.