CVE-2026-68343 (GCVE-0-2026-68343)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-19 16:33
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing. If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path. Validate PathConsumed against the search name length before storing it in the parsed referral.
References
Impacted products
Vendor Product Version
Linux Linux Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad
Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad
Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad
Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad
Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad
Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bfebe5110fd135d86d65a0a346e14c106b02028b",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "5b439f39f33ec15d319ced3b025e122346fba987",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "285bd4a5f3f156aa5869843b47a1b1380b774241",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "2fdd6d196c656b376cc251e1e9ff110b3ed522e1",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "9f88a99ed511651b2dc2177d6854b2d1b8322e75",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "f6f5ee2aa33b350c671721b965251c42cebb962e",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate DFS referral PathConsumed\n\nparse_dfs_referrals() validates that the response contains the fixed\nreferral entry array and, on for-next, the per-referral string offsets.\nHowever, the response also contains a PathConsumed value that is later\nused for DFS path parsing.\n\nIf a malformed response provides a PathConsumed value larger than the\nsearch name, later DFS parsing can advance beyond the end of the path.\n\nValidate PathConsumed against the search name length before storing it in\nthe parsed referral."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The tainted PathConsumed value comes directly from a GET_DFS_REFERRAL response received over TCP/445 from the SMB server, so a malicious or MITM-positioned server on the network fully controls the input to the vulnerable code.\nAC:L - The server simply sets an oversized PathConsumed (up to 65535, and it can also clear the SMB1 UNICODE flag to select the completely unvalidated branch); the resulting out-of-bounds walk past the path buffer is deterministic and needs no race or memory-layout luck.\nPR:N - The attacker is the remote server (or a MITM on an unsigned connection) and needs no account or privilege on the victim client; the client parses the referral response as part of establishing the connection.\nUI:N - DFS referral walks are performed automatically by autofs/systemd automounts, fstab mounts at boot and reconnect-driven remounts, so a forged referral can be delivered without any user action.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and mount context on the client; no VM, IOMMU or sandbox boundary is crossed.\nC:H - prepath = full_path + path_consumed points past the end of the heap path string, and cifs_build_devname() strlen()s and copies from there, splicing adjacent kernel heap contents (up to ~64KB away) into the constructed UNC/prefixpath that is then observable via the mount source and /proc/mounts.\nI:N - The defect is purely an out-of-bounds read; all subsequent allocations and copies are sized from the same over-read string, so no kernel memory is written or corrupted.\nA:H - With PathConsumed up to 65535 the pointer can run far past a small slab object into an unmapped or guarded page, so strlen() on it oopses the mounting task (and panics on panic_on_oops systems)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:33:43.025Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bfebe5110fd135d86d65a0a346e14c106b02028b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b439f39f33ec15d319ced3b025e122346fba987"
        },
        {
          "url": "https://git.kernel.org/stable/c/285bd4a5f3f156aa5869843b47a1b1380b774241"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fdd6d196c656b376cc251e1e9ff110b3ed522e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f88a99ed511651b2dc2177d6854b2d1b8322e75"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6f5ee2aa33b350c671721b965251c42cebb962e"
        }
      ],
      "title": "smb: client: validate DFS referral PathConsumed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68343",
    "datePublished": "2026-08-10T12:03:19.939Z",
    "dateReserved": "2026-07-30T09:28:09.384Z",
    "dateUpdated": "2026-08-19T16:33:43.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.