Linux Kernel CVE-2026-98169

Exploitation requires the victim's Linux host to act as an SMB/CIFS client against an attacker-controlled or compromised SMB3 server AND to actively invoke snapshot enumeration (the smb3_enum_snapshots path / FSCTL_SRV_ENUMERATE_SNAPSHOTS ioctl on the cifs.ko client). The trigger condition is a malicious server returning a reply whose server-supplied OutputCount is smaller than sizeof(struct smb_snapshot_array) (12 bytes / GMT_TOKEN_SIZE), so retbuf is allocated short and ret_data_len exceeds it. LIMITING FACTORS: this is not reachable against default idle clients - it needs (1) an outbound SMB connection the attacker controls, and (2) a user or application that requests snapshots, which is UI:R in the vector; it only affects kernels with the vulnerable cifs client code prior to the fixed stable releases. It is not exploitable by a remote party who cannot get the victim to connect to their server.

This is a genuinely moderate, not high, real-world priority. The input CVSS of 7.1 is driven largely by A:H (High availability impact), which is questionable for what the description actually characterizes: an out-of-bounds *read* in the SMB3 client (smb3_enum_snapshots) that leaks adjacent slab memory to userspace - a confidentiality/information-disclosure issue, not a crash or DoS primitive. The signals are mutually consistent on low urgency: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code is referenced. The CVSS vector itself tempers the AV:N 'network' label with UI:R, meaning exploitation is not a passive remote attack - it requires the victim's Linux client to connect to an attacker-controlled or compromised SMB server and actively perform snapshot enumeration. CONFLICT TO VERIFY: the vector claims A:H, but the described mechanism (copy_to_user reading past a slab buffer) is an information leak with limited confidentiality impact (C:L) and no obvious availability consequence, since slab memory is mapped and unlikely to fault - the official A:H appears overstated relative to the description. Bottom line: a real bug worth patching on the normal kernel-update cadence, but not an emergency; exploitation is server-side-malicious and client-interaction-dependent rather than widespread or wormable.

An attacker stands up a malicious SMB server (or compromises one the victim already trusts) and waits for or lures a Linux client into mounting the share and requesting filesystem snapshots. The server replies to the snapshot-enumeration FSCTL with an undersized OutputCount (smaller than the 12-byte GMT_TOKEN_SIZE/struct), causing the client's copy_to_user to read past the allocated reply buffer and return adjacent kernel slab memory to the requesting user. No public exploit code is referenced at the time of analysis.