Linux Kernel CVE-2026-98318

Requires a Linux client with an SMB/CIFS share mounted using default settings (symlinkroot unset), AND the attacker must have write access to that share to create a malicious absolute native symlink (e.g. target '/ab') that lacks an NT drive prefix. The description explicitly states the bug triggers 'with default settings', so no non-default configuration is needed - but exploitation is limited to the SMB-client processing path: the victim must mount an attacker-influenced share, and the attacker must be able to write symlinks to it. There is no user interaction requirement for the client, but local kernel processing of the crafted symlink is the trigger (AV:L). Not reachable by a pure network attacker who cannot place content on a mounted share.

This is a kernel-side heap/stack memory-corruption flaw in the Linux cifs/smb client (symlink native-target parsing). The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 HIGH) is internally consistent with the description: exploitation requires local processing by a client that has an SMB share mounted, the attacker needs only low privileges (write access to the share, PR:L), no user interaction, and full C/I/A impact from kernel memory corruption. The exploitation signals, however, point to LOW real-world urgency: EPSS is 0.16% (5th percentile), the vulnerability is NOT in CISA KEV, and no public exploit code is identified - there is no public exploit identified at time of analysis. Note the attack is not purely a classic 'local user' scenario: the overflow is triggered when the kernel parses an attacker-controlled absolute symlink target ('/ab') on a mounted share, so the real attacker is anyone with write access to a share the victim mounts (a semi-remote/malicious-server trust-boundary issue that CVSS encodes as AV:L because the kernel parsing happens locally). Overall this is a legitimately patch-worthy memory-safety bug but a low-priority one absent targeting: narrow affected kernel range, default-config reachable but requiring a mounted share and share write access, and no evidence of exploitation.

An attacker with write access to an SMB/CIFS share (e.g. a malicious or compromised file server, or a low-privileged user on a shared export) creates an absolute native symlink with a short target such as '/ab'. When a Linux client with the share mounted (default settings, symlinkroot unset) reads/processes that symlink, the NT-fixup code writes past sym[5]/path[5] and the plen underflow wraps u16 to 65534, causing memcpy() to copy 65534 bytes into a 24-byte buffer and corrupt kernel memory. No public exploit code is identified at time of analysis; realistically this would first manifest as a kernel crash/DoS with potential escalation to code execution.