CVE-2026-72318 (GCVE-0-2026-72318)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
cifs: validate DFS referral string offsets
Summary
In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets parse_dfs_referrals() validates that the response header and referral array fit in the received buffer, but each referral also contains string offsets supplied by the server. Those offsets are used to compute the DfsPath and NetworkAddress string pointers without checking whether they still point inside the response buffer. A malformed referral can therefore make the computed pointer exceed the end of the buffer. The resulting negative max_len is then passed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it to kstrndup() as a size_t, allowing strnlen() to read out of bounds. Validate each string offset before deriving the string pointer.
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 76c607b9353d377b1d1b11db50e743eee0ccf658 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < d64b6be5740ce230aca184d8d224c75d9866045d (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 929a85932d14190988f1eafd6ee8cc68d66ace0b (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < b784cd1c24d89bf71be2efe1e948ff7c03371e57 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < c37abc99bb3de3d3219ecef253d649f74117fd83 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 027a84ac6b50c12ef767c15abfc58aa865820e9e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "76c607b9353d377b1d1b11db50e743eee0ccf658",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "d64b6be5740ce230aca184d8d224c75d9866045d",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "929a85932d14190988f1eafd6ee8cc68d66ace0b",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "b784cd1c24d89bf71be2efe1e948ff7c03371e57",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "c37abc99bb3de3d3219ecef253d649f74117fd83",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "027a84ac6b50c12ef767c15abfc58aa865820e9e",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate DFS referral string offsets\n\nparse_dfs_referrals() validates that the response header and referral\narray fit in the received buffer, but each referral also contains string\noffsets supplied by the server.\n\nThose offsets are used to compute the DfsPath and NetworkAddress string\npointers without checking whether they still point inside the response\nbuffer. A malformed referral can therefore make the computed pointer\nexceed the end of the buffer. The resulting negative max_len is then\npassed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it\nto kstrndup() as a size_t, allowing strnlen() to read out of bounds.\n\nValidate each string offset before deriving the string pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote malicious SMB/DFS server delivers the malformed DFS referral reply over the network when the CIFS client issues FSCTL_DFS_GET_REFERRALS (SMB2) or TRANS2_GET_DFS_REFERRAL (SMB1); no local or physical access is required to reach parse_dfs_referrals().\nAC:L - Once a client session exists, the attacker fully controls referral header fields and per-entry DfsPathOffset/NetworkAddressOffset in the reply; no races, timing, or victim-specific memory layout are needed to trigger the out-of-bounds read reliably.\nPR:N - Exploitation requires no privileges on the victim host\u2014the attacker only needs to operate the SMB server returning the malicious DFS referral; the client kernel parses the response regardless of which local user triggered the referral lookup.\nUI:N - After a DFS CIFS mount or autofs/enterprise logon mount, referral lookups and periodic dfs_cache_refresh work run automatically on file access and reconnect without any additional deliberate user action beyond normal SMB/DFS client use.\nS:U - The flaw corrupts/confidentiality-impacts kernel memory in the same security authority as the CIFS client; it does not by itself cross a hypervisor, IOMMU, or container sandbox boundary distinct from standard kernel compromise.\nC:H - Unvalidated string offsets let DfsPath/NetworkAddress pointers sit past the response buffer; the resulting negative max_len is cast to size_t for kstrndup()/strnlen(), enabling large out-of-bounds reads of adjacent kernel memory (SMB1/non-Unicode path).\nI:L - The bug is an out-of-bounds read that copies attacker-influenced kernel bytes into newly allocated heap buffers rather than an arbitrary write primitive, but heap contents are modified beyond the intended referral data scope.\nA:H - Reading past the SMB response buffer can oops/panic the kernel on unmapped pages, and casting a negative max_len to size_t can drive very large strnlen()/allocation attempts, causing severe denial of service on servers and workstations using DFS mounts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:44.209Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/76c607b9353d377b1d1b11db50e743eee0ccf658"
        },
        {
          "url": "https://git.kernel.org/stable/c/d64b6be5740ce230aca184d8d224c75d9866045d"
        },
        {
          "url": "https://git.kernel.org/stable/c/929a85932d14190988f1eafd6ee8cc68d66ace0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b784cd1c24d89bf71be2efe1e948ff7c03371e57"
        },
        {
          "url": "https://git.kernel.org/stable/c/c37abc99bb3de3d3219ecef253d649f74117fd83"
        },
        {
          "url": "https://git.kernel.org/stable/c/027a84ac6b50c12ef767c15abfc58aa865820e9e"
        }
      ],
      "title": "cifs: validate DFS referral string offsets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72318",
    "datePublished": "2026-08-15T05:55:31.682Z",
    "dateReserved": "2026-08-09T03:40:39.919Z",
    "dateUpdated": "2026-08-17T05:42:44.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72318",
      "date": "2026-08-19",
      "epss": "0.00586",
      "percentile": "0.45463"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72318\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:04.737\",\"lastModified\":\"2026-08-17T06:18:35.193\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncifs: validate DFS referral string offsets\\n\\nparse_dfs_referrals() validates that the response header and referral\\narray fit in the received buffer, but each referral also contains string\\noffsets supplied by the server.\\n\\nThose offsets are used to compute the DfsPath and NetworkAddress string\\npointers without checking whether they still point inside the response\\nbuffer. A malformed referral can therefore make the computed pointer\\nexceed the end of the buffer. The resulting negative max_len is then\\npassed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it\\nto kstrndup() as a size_t, allowing strnlen() to read out of bounds.\\n\\nValidate each string offset before deriving the string pointer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"76c607b9353d377b1d1b11db50e743eee0ccf658\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"d64b6be5740ce230aca184d8d224c75d9866045d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"929a85932d14190988f1eafd6ee8cc68d66ace0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"b784cd1c24d89bf71be2efe1e948ff7c03371e57\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"c37abc99bb3de3d3219ecef253d649f74117fd83\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"027a84ac6b50c12ef767c15abfc58aa865820e9e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.5}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/027a84ac6b50c12ef767c15abfc58aa865820e9e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/76c607b9353d377b1d1b11db50e743eee0ccf658\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/929a85932d14190988f1eafd6ee8cc68d66ace0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b784cd1c24d89bf71be2efe1e948ff7c03371e57\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c37abc99bb3de3d3219ecef253d649f74117fd83\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d64b6be5740ce230aca184d8d224c75d9866045d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-18T20:49:00+00:00",
      "cve": "CVE-2026-72318",
      "id": "CVE-2026-72318",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: cifs: validate DFS referral string offsets",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72318.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.