CVE-2026-98318
High · 7.8CVSS
7.8
EPSS
0.1%
Published
Oct 6, 2026
CISA due date
—
Cloudanix analysis
A flaw in how Linux handles certain links from shared network folders can let someone who can add files to the share crash the system or run their own code.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Missing validation of absolute native symlink targets allows out-of-bounds writes at fixed offsets and an integer underflow that triggers a memcpy of 65534 bytes into a 24-byte buffer when processing SMB symlinks without an NT drive prefix.
Why it matters to the business
Systems mounting untrusted SMB shares face local kernel memory corruption that can lead to crashes or arbitrary code execution, increasing risk of compromise on multi-user or shared Linux environments.
How an attack unfolds
An attacker with write access to a mounted SMB share creates a specially crafted absolute symlink such as "/ab". When the client processes the symlink under default settings, the unvalidated target bypasses prefix checks, causing two out-of-bounds writes followed by a massive memcpy that overflows the destination buffer.
How to fix it
Apply the upstream kernel fix that validates the NT drive prefix and ASCII drive letter before any offset calculations or length subtractions. Rebuild and deploy the patched kernel on all affected systems; until then, restrict write access to SMB mounts or disable symlink following where possible.
How to confirm the fix worked
Confirm the presence of the validation check for NT drive prefix and ASCII drive letter in the smb client symlink handling code. Verify that the fixed kernel version is running and test that malformed absolute symlinks no longer trigger out-of-bounds accesses or underflows.
Typical attack path
- Obtain write access to a mounted SMB share
- Create an absolute native symlink without an NT drive prefix (for example "/ab")
- Trigger SMB client symlink processing code path
- Exploit the resulting buffer overflow for memory corruption or code execution
How to detect it
Review kernel logs for oops or panic messages involving smb client symlink target handling or memcpy overflows. Look for creation of short absolute symlinks on SMB mounts followed by client activity that processes them.
What your security team should do
- Prioritize kernel updates on any Linux systems that mount SMB shares from untrusted sources
- Audit SMB mount options and reduce privileges for users who can write to shares
- Monitor for kernel oops or crashes related to smb client symlink processing
The record
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying the target and calculating the print name length. For "/ab", this causes two failures: sym[5] and path[5] are written past their allocations, and plen -= 2 * poff subtracts an assumed 8-byte prefix from a 6-byte UTF-16 target, wrapping u16 plen to 65534. That underflow causes another overflow: memcpy() copies 65534 bytes into a 24-byte buffer. A user with write access to a mounted share can trigger these bugs with default settings. Validate the NT drive prefix, including an ASCII drive letter, before accessing fixed offsets or subtracting the prefix length.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|