Skip to main content

Linux Kernel CVE-2026-52967

| EUVDEUVD-2026-38835 HIGH
Out-of-bounds Read (CWE-125)
2026-06-24 Linux GHSA-3jxr-5523-52vg
Buffer Overflow Denial Of Service Information Disclosure Linux Red Hat Suse
8.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Network-reachable malicious SMB server, no client auth (PR:N) but victim must connect (UI:R); availability hang is High, OOB under-read is limited so C:L not C:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:36 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.1 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 8.1
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix possible infinite loop and oob read in symlink_data()

On 32-bit architectures, the infinite loop is as follows:

len = p->ErrorDataLength 0xfffffff8 u8 *next = p->ErrorContextData + len next p

On 32-bit architectures, the out-of-bounds read is as follows:

len = p->ErrorDataLength 0xfffffff0 u8 *next = p->ErrorContextData + len next (u8 *)p - 8

AnalysisAI

Out-of-bounds read and denial-of-service in the Linux kernel SMB/CIFS client (cifs.ko) affects systems mounting SMB shares on 32-bit architectures. When parsing a malicious SMB2 error response, the symlink_data() routine mishandles a hostile ErrorDataLength value, causing either an infinite loop or a read past the buffer that can hang the client or leak adjacent kernel memory. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile), but the bug is reachable by any malicious or compromised SMB server a vulnerable client connects to.

Technical ContextAI

The flaw lives in the in-kernel SMB/CIFS client (fs/smb/client), which Linux uses to mount remote Windows/Samba file shares over SMB2/SMB3. When a server returns an SMB2 error response, the client walks a list of error-context records; symlink_data() advances a pointer with 'next = p->ErrorContextData + len' using the server-supplied ErrorDataLength. On 32-bit architectures pointer arithmetic wraps such that a length of 0xfffffff8 makes 'next' equal 'p' (infinite loop / hang) and 0xfffffff0 makes 'next' point 8 bytes before the structure (out-of-bounds read). This is an integer/pointer-arithmetic and bounds-validation failure (CWE class akin to CWE-190 integer overflow leading to CWE-125 out-of-bounds read); the CPE strings identify the affected product as cpe:2.3:a:linux:linux, i.e. the upstream Linux kernel. The vendor tags (Buffer Overflow, Denial Of Service) align with the dual hang/OOB-read impact.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 (or later) - or apply the upstream stable commits referenced at git.kernel.org (e.g. https://git.kernel.org/stable/c/7d9a7f1f96cd617ee9e75bb22217c709038e26b8 and the related 6.x backports). For systems that cannot patch immediately, the practical compensating control is to avoid mounting SMB/CIFS shares from untrusted or attacker-controllable servers and to restrict outbound SMB (TCP 445) so kernel CIFS clients only reach known-good file servers; the trade-off is that legitimate access to new file servers must be explicitly allowed. Because the bug is specific to 32-bit kernels, migrating affected hosts to a 64-bit kernel also removes the wrapping-arithmetic precondition, though that is a larger operational change. Track distribution advisories (Debian/Ubuntu/RHEL/SUSE) for the backported point release matching your kernel branch.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-52967 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy