EUVD-2026-76544
GHSA-j6wx-7c3w-595c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
AC:H because attacker must control the SMB server or hold a MITM position; C:L for potential 2-byte adjacent slab read; A:H for kernel panic.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
reparse_buf_ptr() reads buf->ReparseDataLength before checking that count covers the full fixed header:
buf = (struct reparse_data_buffer *)((u8 *)io + off); len = sizeof(*buf); /* 8 bytes */ rdlen = le16_to_cpu(buf->ReparseDataLength); /* offset 4, 2 bytes */
if (count < len || count < rdlen + len) /* check comes after */
struct reparse_data_buffer has ReparseDataLength at offset 4. If a server returns OutputCount < 6, the read at offset 4-5 reaches past the end of the received data. The off+count bounds against iov_len were already validated, but that does not protect against count being smaller than sizeof(*buf).
Split the check: verify count >= sizeof(*buf) before reading ReparseDataLength, then verify count covers the data region.
AnalysisAI
Out-of-bounds read in the Linux kernel SMB client's reparse_buf_ptr() function allows a malicious or MITM-positioned SMB server to trigger a kernel-level OOB memory read by returning a crafted IOCTL response with OutputCount below 6 bytes. The function reads ReparseDataLength at byte offset 4-5 of struct reparse_data_buffer before verifying that count covers the full 8-byte fixed header, exposing unvalidated memory and potentially crashing the client kernel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Linux system running a kernel in the affected version range with the CIFS/SMB client module (cifs.ko) compiled in or loaded, and the client must be actively mounting or communicating with an SMB server (default port TCP/445 or TCP/139). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate despite the 8.2 CVSS base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 7.2.4 or later, or apply the upstream stable fix commits 711cf71300d7992f450600df8864917d3538679f and 05f78e6cf34ea3a285053bd5999e08e8ac298bd5 available at https://git.kernel.org/stable/c/711cf71300d7992f450600df8864917d3538679f and https://git.kernel.org/stable/c/05f78e6cf34ea3a285053bd5999e08e8ac298bd5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog Linux systems in your environment using SMB client functionality (CIFS mounts, network file access) and document which external or untrusted SMB servers they connect to. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today