Linux Kernel EUVD-2026-76544

Exploitation requires a Linux system running a kernel in the affected version range with the CIFS/SMB client module (cifs.ko) compiled in or loaded, and the client must be actively mounting or communicating with an SMB server (default port TCP/445 or TCP/139). The attacker must either control the SMB server endpoint the client connects to (e.g., via DNS poisoning directing the client to a rogue server, or by operating a legitimate-looking share) or hold a MITM position on the network path to intercept and modify server responses. Non-default condition: SMB client mounts are not enabled by default on most Linux distributions; an explicit mount configuration or automount entry must be present. Exploitation is not possible against arbitrary Linux hosts from the internet without first achieving network positioning or server control - the raw CVSS AV:N/AC:L characterization overstates direct reachability.

Real-world risk is moderate despite the 8.2 CVSS base score. The input vector's AV:N/AC:L overstates accessibility: successful exploitation requires the Linux SMB client to connect to an attacker-controlled server or for the attacker to hold a MITM position on the network path to a legitimate server, making AC:H a more accurate characterization. EPSS at 0.15% and the 5th percentile is consistent with no weaponized exploit and a narrow attack surface confined to hosts actively mounting SMB/CIFS shares. Even a mid-sized municipal IT team in gliwice running Linux file servers with CIFS automounts should treat this as a routine patch-cycle item rather than an emergency, given the absence of KEV listing or public POC. The C:L impact in the CVSS is plausible - up to 2 bytes of adjacent slab memory are readable before the crash - but the primary real-world outcome is kernel panic or stability degradation (A:H). The fix is in upstream stable with two confirmed patch commits, and the remediation carries negligible regression risk.

An attacker with a MITM position between a Linux client and its SMB server intercepts an IOCTL reparse-point response and replaces it with a crafted reply whose OutputCount is set to a value below 6. When the kernel's reparse_buf_ptr() processes this response, it reads ReparseDataLength at bytes 4-5 before the bounds check executes, triggering an OOB read that either crashes the kernel or discloses up to 2 bytes of adjacent slab memory to an attacker able to observe the effect. No public POC exists; exploitation requires network-level positioning or control of the SMB server endpoint the client connects to.