CVE-2026-98168
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix reparse buffer bounds in cifs_query_reparse_point() In cifs_query_reparse_point(), the start >= end check before casting to struct reparse_data_buffer * only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure. If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds. Fix this by ensuring the remaining space is at least the size of the reparse_data_buffer structure before accessing its fields.
Affected versions
Linux kernel versions
6.12.34,
6.6.94,
6.15.3,
6.16
and later are affected. Fixed in
6.12.112,
6.18.54,
7.2.8,
7.3-rc4
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98168?
CVE-2026-98168 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.12.34 onward and has been patched in 6.12.112, 6.18.54, 7.2.8 and others. CVE-2026-98168 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98168?
Yes. CVE-2026-98168 has been patched. Fixed versions include 6.12.112, 6.18.54, 7.2.8 and others. If you are running Linux kernel 6.12.34 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98168 actively exploited?
No. CVE-2026-98168 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.