CVE-2026-68343
Critical · 9.1CVSS
9.1
EPSS
0.5%
Published
Aug 10, 2026
CISA due date
—
Cloudanix analysis
A bug in how Linux handles certain network file referrals could let a malicious server cause crashes or leak data on affected systems, so organizations should install the vendor kernel update as soon as it is available.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Data Exposure
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
A malformed DFS referral response can supply a PathConsumed value exceeding the search name length, allowing subsequent DFS path parsing to read or write past the end of the supplied path buffer in the SMB client.
Why it matters to the business
Unpatched Red Hat Enterprise Linux and RHCOS systems that mount SMB shares via DFS referrals face elevated risk of remote denial of service or information disclosure, potentially disrupting file services and requiring emergency patching within standard change windows.
How an attack unfolds
An attacker who can influence or impersonate a DFS referral server returns a crafted referral response containing an oversized PathConsumed field; when the victim kernel parses the path it advances beyond the allocated buffer, enabling memory corruption that may be leveraged for further attacks.
How to fix it
Upgrade the kernel package on Red Hat Enterprise Linux 9 to version 5.14.0-687.41.1.el9_8 or later and RHCOS to 4.22.9.8.202608251819-0 or later as provided in RHSA-2026:57252; reboot after installation.
How to confirm the fix worked
Confirm the installed kernel version matches or exceeds the fixed releases listed in RHSA-2026:57252; re-test DFS referral handling with a controlled malicious referral server if possible.
Typical attack path
- Attacker positions themselves to supply DFS referrals (compromised server, MITM, or malicious share).
- Victim initiates SMB connection that triggers DFS referral lookup.
- Server responds with referral entry whose PathConsumed value exceeds the search name length.
- Kernel stores the unchecked value and later uses it to index into the path buffer during DFS path processing.
- Out-of-bounds access occurs, resulting in crash or memory corruption.
How to detect it
Review system logs for unexpected SMB client crashes or oops messages containing DFS referral parsing functions after SMB mount attempts; correlate with network traffic showing unusual PathConsumed values in referral responses if packet capture is available.
What your security team should do
- Apply the vendor-supplied kernel updates within the next maintenance window.
- Prioritize systems that regularly mount DFS-enabled SMB shares.
- Monitor upstream kernel commits and Red Hat advisories for backports to other streams.
- Temporarily restrict DFS referrals via mount options where operationally feasible until patches are deployed.
The record
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing. If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path. Validate PathConsumed against the search name length before storing it in the parsed referral.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|