CVE-2026-98168

What it actually does

Insufficient bounds check in cifs_query_reparse_point allows out-of-bounds read of the 8-byte reparse_data_buffer header (ReparseTag and ReparseDataLength) when a server-supplied DataOffset leaves fewer than 8 bytes remaining in the response buffer.

Why it matters to the business

Organizations using Linux SMB clients to access file shares risk kernel memory disclosure or crashes when connecting to untrusted or compromised servers, potentially exposing sensitive data or causing service disruption; low EPSS and absence from KEV indicate limited observed exploitation so far.

How an attack unfolds

An attacker hosts a malicious SMB server and returns a reparse point response whose DataOffset field positions the buffer start such that less than 8 bytes remain; the existing start >= end check passes, allowing subsequent field accesses to read past the allocated response and leak kernel memory or trigger faults.

How to fix it

Apply the upstream kernel fix that adds an explicit remaining-space check of at least sizeof(struct reparse_data_buffer) before casting and accessing the header fields; rebuild and deploy the patched kernel on all systems using the CIFS/SMB client.

How to confirm the fix worked

Confirm the patch is present by inspecting the cifs_query_reparse_point function for the additional remaining >= sizeof(struct reparse_data_buffer) test; test by replaying a short-buffer reparse response and verifying no out-of-bounds access occurs.

Typical attack path

1. Attacker sets up a rogue SMB server responding to client connections
2. Linux SMB client issues a reparse point query via cifs_query_reparse_point
3. Server supplies a DataOffset leaving insufficient bytes for the reparse header
4. Kernel reads ReparseTag and ReparseDataLength out-of-bounds
5. Attacker observes resulting memory disclosure or denial-of-service

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log) for oops, warnings, or stack traces mentioning cifs_query_reparse_point or reparse_data_buffer during SMB activity; correlate with unusual SMB server connections.

What your security team should do

• Prioritize kernel updates for any systems mounting SMB shares from external or untrusted servers
• Review SMB client usage and restrict connections to trusted servers until patched
• Monitor EPSS and KEV updates given the 17-day publication window