UBUNTU-CVE-2026-98168: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifsqueryreparsepoint() In cifsqueryreparsepoint(), the start >= end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparsedatabuffer structure before accessing its fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In cifs_query_reparse_point(), verify that the remaining response-buffer space is at least the size of struct reparse_data_buffer (the fixed 8-byte header) before casting or accessing ReparseTag and ReparseDataLength.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker would need to control or operate an SMB server that provides a crafted reparse-point response. The response must contain a DataOffset that leaves fewer than 8 bytes available after the indicated start position.
Which systems are exposed?
Systems using an affected Ubuntu Linux kernel package and acting as an SMB client are exposed when they query reparse points from an untrusted or malicious SMB server. The listed packages are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
How can I tell whether a server is attempting to trigger the issue?
The relevant condition is an SMB reparse-point response whose DataOffset points within the response buffer but leaves less than the fixed 8-byte reparse_data_buffer header remaining. Detecting this requires inspection of SMB responses or kernel-level diagnostics during reparse-point queries.