CVE-2026-97560: smb: client: fix one-byte OOB read in smb2_parse_native_symlink()

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix one-byte OOB read in smb2parsenativesymlink()

When parsing a share-root relative native symlink, memcpy copies smbtarget+1 (skipping the leading separator) but uses strlen(smbtarget)+1 as the length, reading one byte past the allocated buffer.

This fixes the following KASAN splat when accessing an SMB symlink with a target of '\a\b':

BUG: KASAN: slab-out-of-bounds in smb2parsenativesymlink+0x4f5/0xca0 Read of size 5 at addr ffff88800878fe21 by task netfsfuzz-execu/1 CPU: 1 UID: 0 PID: 1 Comm: netfsfuzz-execu Tainted: G N 7.2.0-11943-g2709dd5ae32f-dirty #1 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996) Call Trace: <TASK> dumpstacklvl+0x7b/0xa0 printreport+0xd0/0x630 kasanreport+0xe5/0x120 kasancheckrange+0x105/0x1b0 asanmemcpy+0x23/0x60 smb2parsenativesymlink+0x4f5/0xca0 parsereparsepoint+0x68a/0x1530 reparseinfotofattr+0x752/0xa20 cifsgetfattr+0x873/0x15b0 cifsgetinodeinfo+0xc0/0x310 cifslookup+0x308/0xa70 lookupslow+0x122/0x2b0 lookupslow+0x50/0x70 pathlookupat+0x525/0xaf0 filenamelookup+0x1f2/0x550 vfsstatx+0xd1/0x1a0 vfsfstatat+0x65/0xc0 dosysnewfstatat+0x9a/0x120 dosyscall64+0xdd/0x4a0 entrySYSCALL64afterhwframe+0x77/0x7f

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:21 AM
Data Sourced
via MITRE·10:21 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

What condition triggers the out-of-bounds read?

The read is triggered when the SMB client parses a share-root-relative native symlink. The reported reproducer uses a symlink target of '\a\b'.

2

How can I tell whether this issue has occurred on a system?

Kernel AddressSanitizer can report a slab-out-of-bounds read in smb2_parse_native_symlink. The supplied trace shows the path through parse_reparse_point, reparse_info_to_fattr, cifs_get_fattr, and cifs_lookup while accessing the SMB symlink.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203