CVE-2026-98168
smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
Description
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.
INFO
Published Date :
Oct. 6, 2026, 9:17 a.m.
Last Modified :
Oct. 21, 2026, 1:21 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel to the latest patched version.
- Ensure remaining space is sufficient for reparse data.
- Apply the fix to cifs_query_reparse_point() function.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-98168.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-98168 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-98168
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-98168 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-98168 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 21, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98168.json">CVE-2026-98168</a> Added Reference https://git.kernel.org/stable/c/aa00eead258e4fe8158a3a3e2d65facf06274abd -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 19, 2026
Action Type Old Value New Value Added Affected Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98168.json">CVE-2026-98168</a> -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 06, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/98xxx/CVE-2026-98168.json">CVE-2026-98168</a> Added Reference https://git.kernel.org/stable/c/3d67f155fe5813cfb02a551a9a12d6ea06a902e9 Added Reference https://git.kernel.org/stable/c/5f0306e731e2f46e91419eae57eee3a241c055e0 Added Reference https://git.kernel.org/stable/c/8dc5db3a0e583ea8d31d0613cefd99e93e095c3c Added Reference https://git.kernel.org/stable/c/d1152c96a3002e3df6b9a5b007cecaa7b19b4f79