EUVD-2026-38835
GHSA-3jxr-5523-52vg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Network-reachable malicious SMB server, no client auth (PR:N) but victim must connect (UI:R); availability hang is High, OOB under-read is limited so C:L not C:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix possible infinite loop and oob read in symlink_data()
On 32-bit architectures, the infinite loop is as follows:
len = p->ErrorDataLength 0xfffffff8 u8 *next = p->ErrorContextData + len next p
On 32-bit architectures, the out-of-bounds read is as follows:
len = p->ErrorDataLength 0xfffffff0 u8 *next = p->ErrorContextData + len next (u8 *)p - 8
AnalysisAI
Out-of-bounds read and denial-of-service in the Linux kernel SMB/CIFS client (cifs.ko) affects systems mounting SMB shares on 32-bit architectures. When parsing a malicious SMB2 error response, the symlink_data() routine mishandles a hostile ErrorDataLength value, causing either an infinite loop or a read past the buffer that can hang the client or leak adjacent kernel memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to connect/mount an SMB/CIFS share from a server the attacker controls or has compromised (this is the UI:R user-interaction requirement), and the client host must run a 32-bit Linux kernel - on 64-bit kernels the described pointer arithmetic does not wrap and the bug is not triggered. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mostly consistent but moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up (or compromises) an SMB server and lures a 32-bit Linux host into mounting a share from it - for example via a malicious URI, autofs, or a poisoned network location. When the client issues a request, the server returns a crafted SMB2 error response with ErrorDataLength set to 0xfffffff8 or 0xfffffff0, causing the kernel CIFS client to spin in an infinite loop (hang) or read kernel memory out of bounds. … |
| Remediation | Vendor-released patch: update to a fixed stable kernel - 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 (or later) - or apply the upstream stable commits referenced at git.kernel.org (e.g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and catalog all 32-bit Linux systems with active SMB client mounts, prioritizing production infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today