CVE-2026-98452

A flaw was found in the Linux kernel's Server Message Block (SMB) client. When opening cached directories, the client fails to validate server responses to compound commands before reading their contents and handling file identifiers. A malicious or compromised SMB server could exploit this flaw by returning a malformed or unexpected response, causing invalid memory access and resulting in a Denial of Service (DoS) via a kernel crash.

This vulnerability is rated as Moderate impact because triggering the flaw requires an explicit connection to a malicious or compromised SMB server, limiting exposure to client-initiated outbound traffic rather than unsolicited remote requests. In standard Red Hat Enterprise Linux environments, the kernel SMB client is not invoked unless a remote share is intentionally mounted. The potential impact is confined to a local system crash and denial of service, with no compromise of data confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.