CVE-2026-97560: smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix one-byte OOB read in smb2parsenativesymlink()
When parsing a share-root relative native symlink, memcpy copies smbtarget+1 (skipping the leading separator) but uses strlen(smbtarget)+1 as the length, reading one byte past the allocated buffer.
This fixes the following KASAN splat when accessing an SMB symlink with a target of '\a\b':
BUG: KASAN: slab-out-of-bounds in smb2parsenativesymlink+0x4f5/0xca0 Read of size 5 at addr ffff88800878fe21 by task netfsfuzz-execu/1 CPU: 1 UID: 0 PID: 1 Comm: netfsfuzz-execu Tainted: G N 7.2.0-11943-g2709dd5ae32f-dirty #1 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996) Call Trace: <TASK> dumpstacklvl+0x7b/0xa0 printreport+0xd0/0x630 kasanreport+0xe5/0x120 kasancheckrange+0x105/0x1b0 asanmemcpy+0x23/0x60 smb2parsenativesymlink+0x4f5/0xca0 parsereparsepoint+0x68a/0x1530 reparseinfotofattr+0x752/0xa20 cifsgetfattr+0x873/0x15b0 cifsgetinodeinfo+0xc0/0x310 cifslookup+0x308/0xa70 lookupslow+0x122/0x2b0 lookupslow+0x50/0x70 pathlookupat+0x525/0xaf0 filenamelookup+0x1f2/0x550 vfsstatx+0xd1/0x1a0 vfsfstatat+0x65/0xc0 dosysnewfstatat+0x9a/0x120 dosyscall64+0xdd/0x4a0 entrySYSCALL64afterhwframe+0x77/0x7f
Affected Software
Event History
Frequently Asked Questions
What condition triggers the out-of-bounds read?
The read is triggered when the SMB client parses a share-root-relative native symlink. The reported reproducer uses a symlink target of '\a\b'.
How can I tell whether this issue has occurred on a system?
Kernel AddressSanitizer can report a slab-out-of-bounds read in smb2_parse_native_symlink. The supplied trace shows the path through parse_reparse_point, reparse_info_to_fattr, cifs_get_fattr, and cifs_lookup while accessing the SMB symlink.