CVE-2026-43112

What it actually does

This flaw is an out-of-bounds read in the Linux kernel CIFS/SMB client path-sanitization logic, specifically in cifs_sanitize_prepath. When the kernel processes an empty SMB prepath or a path made only of delimiters such as "/", the code can read memory before the start of the expected buffer. Because the bug is in kernel-space SMB client handling, successful triggering can cause kernel memory disclosure, kernel instability, or denial of service, and the assigned CVSS vector indicates a worst-case impact to confidentiality, integrity, and availability when a user or automated workflow initiates interaction with a malicious or malformed SMB resource.

Why it matters to the business

Organizations using Linux systems that mount or access SMB/CIFS shares may face workstation, server, or appliance crashes if a malformed SMB path is processed. In higher-impact scenarios, the flaw could contribute to exposure of sensitive kernel memory or compromise of system integrity. The risk is elevated for environments where users, scripts, backup jobs, file-ingestion systems, or desktop environments automatically access SMB links or mounts from untrusted networks. However, current public exploit maturity is listed as none, EPSS is low and stable, and the vulnerability is not currently in CISA KEV, so prioritization should focus first on internet-adjacent, user-facing, and automation-heavy Linux systems that use CIFS/SMB clients.

How an attack unfolds

An attacker would position or advertise an SMB/CIFS resource, UNC-style path, mount target, shortcut, configuration entry, or workflow input that causes a vulnerable Linux client to process an empty prepath or a delimiter-only prepath. A user, service, script, desktop file manager, backup process, or mount helper must then attempt to access or mount that resource. During client-side path sanitization, the vulnerable kernel code strips leading delimiters and then checks memory before the cursor has advanced, resulting in an out-of-bounds read. Depending on kernel build, memory layout, hardening, and runtime conditions, the observable result may be a kernel oops, panic, client crash, service disruption, or potentially exposure of adjacent kernel memory. There are no named threat actors or known ransomware campaigns reported for this issue in the provided data.

How to fix it

Upgrade affected Linux kernels to vendor-provided fixed builds that include the fs/smb/client cifs_sanitize_prepath bounds-checking fix. No exact fixed versions were provided in the input, so use the relevant Linux distribution, appliance, cloud image, container-host, or kernel vendor advisory to identify the corrected package. Prioritize systems that load the CIFS kernel module, mount SMB shares, use /etc/fstab CIFS entries, run mount.cifs, or automatically browse network file shares. If immediate patching is not possible, reduce exposure by disabling or unloading the CIFS module where not required, blocking outbound SMB to untrusted networks, preventing users and services from mounting untrusted SMB shares, and restricting SMB access to trusted file servers only. Reboot or otherwise ensure the updated kernel is running after patch installation; installing a kernel package alone is not sufficient if the host continues running the vulnerable kernel.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel, not only the installed kernel package, is at or above the fixed vendor build. Check distribution security advisories and package changelogs for references to the CIFS/SMB client fix, cifs_sanitize_prepath, or the associated CVE. Validate exposure by checking whether CIFS support is loaded or used through commands and artifacts such as loaded kernel modules, mount tables, fstab entries, systemd mount units, and use of mount.cifs. Review whether affected systems can initiate SMB connections to untrusted destinations. In test environments only, regression testing should confirm that empty or delimiter-only SMB prepaths are rejected or return safely rather than causing a kernel oops, KASAN finding, or crash.

Typical attack path

1. Identify Linux systems likely to access SMB/CIFS resources, such as file-sharing clients, backup agents, desktop endpoints, build systems, or NAS-integrated workloads.
2. Prepare or influence an SMB/CIFS path, mount target, link, configuration value, or network share reference that results in an empty prepath or delimiter-only prepath such as "/".
3. Induce a user, scheduled task, service, or automated workflow to access or mount the malformed SMB/CIFS resource.
4. Trigger cifs_sanitize_prepath in the vulnerable kernel CIFS client code path.
5. Cause an out-of-bounds kernel read, potentially resulting in kernel crash, denial of service, memory disclosure, or broader system compromise depending on exploitation reliability and kernel mitigations.

How to detect it

To determine whether this was already triggered, review kernel and system logs for crashes, oops reports, KASAN/AddressSanitizer-style findings, or call traces involving the Linux CIFS/SMB client and cifs_sanitize_prepath. Relevant log sources include dmesg output, journald kernel logs, /var/log/kern.log, /var/log/messages, /var/log/syslog, crash dump repositories, kdump/vmcore records, endpoint telemetry, and EDR process/network telemetry showing mount.cifs or automated services connecting to SMB servers shortly before a kernel fault. Correlate any crash with outbound TCP/445 or TCP/139 connections, new SMB mounts, automount events, file-manager browsing of SMB locations, or scheduled jobs that process SMB paths. Look for delimiter-only or otherwise malformed SMB path inputs in mount units, fstab changes, shell history, automation logs, configuration-management diffs, and application logs that construct SMB paths. Absence of these artifacts does not prove non-exploitation, because a kernel crash may truncate logs or leave only a vmcore.

• cifs_sanitize_prepath
• BUG: KASAN:
• BUG: KASAN: slab-out-of-bounds in cifs_sanitize_prepath
• BUG: KASAN: global-out-of-bounds in cifs_sanitize_prepath
• BUG: KASAN: user-memory-access in cifs_sanitize_prepath
• BUG: unable to handle kernel paging request
• Oops:
• kernel BUG at fs/smb/client
• fs/smb/client
• CIFS:
• SMB3:
• mount.cifs
• mount error
• //
• type cifs
• cifs.ko
• /sbin/mount.cifs
• /usr/sbin/mount.cifs
• /proc/fs/cifs
• /proc/fs/cifs/DebugData
• /etc/fstab
• CIFS VFS:
• Call Trace:
• RIP: cifs_sanitize_prepath
• TCP/445
• TCP/139

What your security team should do

• Inventory Linux systems that use CIFS/SMB client functionality, including servers, desktops, backup hosts, file-transfer systems, and appliances based on Linux.
• Prioritize patching for systems that access SMB shares from user-controlled, partner-controlled, or otherwise untrusted networks.
• Apply vendor-fixed kernel updates and reboot into the fixed kernel; verify the running kernel version after maintenance.
• Restrict outbound SMB traffic to approved file servers and block SMB to the internet or untrusted network segments wherever possible.
• Disable or unload the CIFS kernel module on systems that do not require SMB/CIFS access.
• Review fstab entries, systemd mount units, automount configurations, backup jobs, and scripts for SMB paths that could be influenced by untrusted input.
• Monitor kernel logs for crashes or sanitizer reports referencing CIFS, SMB3, or cifs_sanitize_prepath.
• Because EPSS is currently low and no KEV listing or public exploit maturity is reported, handle through standard kernel patch cycles unless the system uses untrusted SMB resources or has high availability requirements.