EUVD-2026-76546
GHSA-959h-4fxq-gqhj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Client-side flaw needing a malicious/MITM SMB server and a specific near-UINT32_MAX length (AC:H); no auth on the client (PR:N); mainly a loop-hang DoS (A:H) with only small stale-data leak (C:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix ALIGN() overflow in symlink_data() error context loop
The check added by commit 7d9a7f1f96cd ("smb/client: fix possible infinite loop and oob read in symlink_data()") compared the post-ALIGN length against the remaining buffer, but ALIGN() itself can overflow: for ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9), ALIGN(x, 8) wraps to 0, so the subsequent bounds check passes, and the loop advances by zero bytes leaving 'p' pointing into stale data.
Fix by checking the raw ErrorDataLength against the remaining space before applying ALIGN(), then checking again after. Since raw_len is bounded by the buffer, raw_len + 7 cannot overflow, so the second check is an exact post-alignment bounds guard.
AnalysisAI
Denial of service and stale-memory disclosure in the Linux kernel SMB/CIFS client (cifs.ko) arise from an integer-overflow in symlink_data()'s error-context parsing loop. A previous fix (commit 7d9a7f1f96cd) checked the post-ALIGN() length against the remaining buffer, but ALIGN() itself overflows: an ErrorDataLength near UINT32_MAX (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a Linux host acting as an SMB/CIFS client that establishes a mount/connection to a malicious or man-in-the-middle SMB server; the server must return a crafted symlink error-context response with ErrorDataLength within 7 of UINT32_MAX (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H) overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading to a fixed kernel: 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or your distribution's backport containing the corresponding git.kernel.org stable commits listed above), which check the raw ErrorDataLength against remaining space before applying ALIGN() and again after. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit Linux systems for SMB/CIFS client usage and identify those running vulnerable kernel versions (6.12.x before 6.12.109, 6.18.x before 6.18.50, 7.0-7.2.x before 7.2.4, or early 7.3-rc builds). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today