What is the CVSS score of EUVD-2026-59217?

EUVD-2026-59217 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59217?

Linux kernel systems mounting SMB network shares are exposed to kernel memory disclosure and denial of service through CVE-2026-72318, a critical out-of-bounds read in the CIFS/SMB client DFS…. A patch is available.

How to fix or mitigate EUVD-2026-59217?

Within 24 hours, inventory all systems mounting SMB shares to identify exposure to DFS referrals and verify current kernel versions. Within 7 days, obtain the patched Linux kernel version from your distribution vendor and begin staged deployment to production systems prioritized by SMB share criticality. Within 30 days, complete deployment of the patched kernel to all affected systems and validate DFS referral functionality post-patch.

Linux Kernel EUVD-2026-59217

| CVE-2026-72318 CRITICAL

2026-08-15 Linux

GHSA-4cv4-fc78-7hch

Information Disclosure Linux Red Hat Suse

9.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

vuln.today AI

7.4 HIGH

Remote malicious/MITM SMB server needed and victim must mount a DFS path (AC:H, not attacker-initiated); no auth or UI once mounting; impact is memory leak (C:H) and crash (A:H), no integrity effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 08:24 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.4 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:55 cve.org

CRITICAL 9.4

CVE Published

Aug 15, 2026 - 05:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

cifs: validate DFS referral string offsets

parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server.

Those offsets are used to compute the DfsPath and NetworkAddress string pointers without checking whether they still point inside the response buffer. A malformed referral can therefore make the computed pointer exceed the end of the buffer. The resulting negative max_len is then passed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it to kstrndup() as a size_t, allowing strnlen() to read out of bounds.

Validate each string offset before deriving the string pointer.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) affects hosts that mount SMB shares involving DFS referrals. A malicious or man-in-the-middle SMB server can return a referral whose server-supplied string offsets point beyond the received response buffer; the unchecked offset yields a negative max_len that reaches kstrndup()/strnlen() as a size_t, causing an out-of-bounds read that can leak adjacent kernel memory or crash the client. CVSS is 9.4, but there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 12th percentile), indicating no observed exploitation.

Technical ContextAI

The flaw is in the kernel CIFS/SMB client (fs/smb/client, cifs.ko) handling of Distributed File System (DFS) referrals returned by an SMB server. parse_dfs_referrals() correctly validates that the response header and the referral array fit within the received buffer, but each referral entry additionally carries server-controlled string offsets for the DfsPath and NetworkAddress UTF-16 strings. These offsets are used to derive string pointers without confirming the target still lies inside the response buffer, so a crafted offset produces a pointer past the buffer end and a negative computed length. That length is passed to cifs_strndup_from_utf16(), and on the non-Unicode path forwarded to kstrndup() as a size_t, so strnlen() reads out of bounds. The CWE was not assigned in the input, but the root cause is a classic out-of-bounds read from an untrusted, unvalidated length/offset (CWE-125, with elements of CWE-822 untrusted pointer offset). Affected CPE is cpe:2.3:a:linux:linux.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc3 (or later) matching your branch, applying the distribution kernel that incorporates commits such as 76c607b9353d377b1d1b11db50e743eee0ccf658 and 027a84ac6b50c12ef767c15abfc58aa865820e9e; verify via https://git.kernel.org/stable/c/ and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-72318. Where immediate patching is not possible, reduce exposure by not mounting CIFS/SMB shares from untrusted, external, or multi-tenant servers and by avoiding DFS-based mounts (trade-off: breaks environments that rely on DFS namespaces); require SMB traffic to stay on trusted, authenticated network paths (VPN/segmented VLAN) to blunt MITM referral injection (trade-off: operational overhead and no protection against a compromised legitimate server); and unload or blacklist the cifs kernel module on hosts that never use SMB (trade-off: no CIFS mounts available at all). These controls limit reachability but do not fix the underlying parsing flaw, so patching remains primary.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-59217 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59217

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code