CVE-2026-98168

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix reparse buffer bounds in cifs_query_reparse_point()

In cifs_query_reparse_point(), the start >= end check before casting to

struct reparse_data_buffer * only ensures the start pointer is within the

response. It fails to verify that there is enough space remaining for the

fixed 8-byte header of the structure.

If a server provides a DataOffset that leaves less than 8 bytes remaining,

the check passes, but subsequent reads of ReparseTag and ReparseDataLength

will occur out-of-bounds.

Fix this by ensuring the remaining space is at least the size of the

reparse_data_buffer structure before accessing its fields.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References