GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68343 (GCVE-0-2026-68343)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-08-19 16:33
VLAI
Title
smb: client: validate DFS referral PathConsumed
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() validates that the response contains the fixed referral entry array and, on for-next, the per-referral string offsets. However, the response also contains a PathConsumed value that is later used for DFS path parsing. If a malformed response provides a PathConsumed value larger than the search name, later DFS parsing can advance beyond the end of the path. Validate PathConsumed against the search name length before storing it in the parsed referral.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < bfebe5110fd135d86d65a0a346e14c106b02028b (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 5b439f39f33ec15d319ced3b025e122346fba987 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 285bd4a5f3f156aa5869843b47a1b1380b774241 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 2fdd6d196c656b376cc251e1e9ff110b3ed522e1 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < 9f88a99ed511651b2dc2177d6854b2d1b8322e75 (git)
Affected: 4ecce920e13ace16a5ba45efe8909946c28fb2ad , < f6f5ee2aa33b350c671721b965251c42cebb962e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bfebe5110fd135d86d65a0a346e14c106b02028b",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "5b439f39f33ec15d319ced3b025e122346fba987",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "285bd4a5f3f156aa5869843b47a1b1380b774241",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "2fdd6d196c656b376cc251e1e9ff110b3ed522e1",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "9f88a99ed511651b2dc2177d6854b2d1b8322e75",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            },
            {
              "lessThan": "f6f5ee2aa33b350c671721b965251c42cebb962e",
              "status": "affected",
              "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate DFS referral PathConsumed\n\nparse_dfs_referrals() validates that the response contains the fixed\nreferral entry array and, on for-next, the per-referral string offsets.\nHowever, the response also contains a PathConsumed value that is later\nused for DFS path parsing.\n\nIf a malformed response provides a PathConsumed value larger than the\nsearch name, later DFS parsing can advance beyond the end of the path.\n\nValidate PathConsumed against the search name length before storing it in\nthe parsed referral."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The tainted PathConsumed value comes directly from a GET_DFS_REFERRAL response received over TCP/445 from the SMB server, so a malicious or MITM-positioned server on the network fully controls the input to the vulnerable code.\nAC:L - The server simply sets an oversized PathConsumed (up to 65535, and it can also clear the SMB1 UNICODE flag to select the completely unvalidated branch); the resulting out-of-bounds walk past the path buffer is deterministic and needs no race or memory-layout luck.\nPR:N - The attacker is the remote server (or a MITM on an unsigned connection) and needs no account or privilege on the victim client; the client parses the referral response as part of establishing the connection.\nUI:N - DFS referral walks are performed automatically by autofs/systemd automounts, fstab mounts at boot and reconnect-driven remounts, so a forged referral can be delivered without any user action.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and mount context on the client; no VM, IOMMU or sandbox boundary is crossed.\nC:H - prepath = full_path + path_consumed points past the end of the heap path string, and cifs_build_devname() strlen()s and copies from there, splicing adjacent kernel heap contents (up to ~64KB away) into the constructed UNC/prefixpath that is then observable via the mount source and /proc/mounts.\nI:N - The defect is purely an out-of-bounds read; all subsequent allocations and copies are sized from the same over-read string, so no kernel memory is written or corrupted.\nA:H - With PathConsumed up to 65535 the pointer can run far past a small slab object into an unmapped or guarded page, so strlen() on it oopses the mounting task (and panics on panic_on_oops systems)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:33:43.025Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bfebe5110fd135d86d65a0a346e14c106b02028b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b439f39f33ec15d319ced3b025e122346fba987"
        },
        {
          "url": "https://git.kernel.org/stable/c/285bd4a5f3f156aa5869843b47a1b1380b774241"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fdd6d196c656b376cc251e1e9ff110b3ed522e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f88a99ed511651b2dc2177d6854b2d1b8322e75"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6f5ee2aa33b350c671721b965251c42cebb962e"
        }
      ],
      "title": "smb: client: validate DFS referral PathConsumed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68343",
    "datePublished": "2026-08-10T12:03:19.939Z",
    "dateReserved": "2026-07-30T09:28:09.384Z",
    "dateUpdated": "2026-08-19T16:33:43.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68343",
      "date": "2026-09-16",
      "epss": "0.00513",
      "percentile": "0.42445"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68343\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:24.830\",\"lastModified\":\"2026-08-19T17:20:44.083\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsmb: client: validate DFS referral PathConsumed\\n\\nparse_dfs_referrals() validates that the response contains the fixed\\nreferral entry array and, on for-next, the per-referral string offsets.\\nHowever, the response also contains a PathConsumed value that is later\\nused for DFS path parsing.\\n\\nIf a malformed response provides a PathConsumed value larger than the\\nsearch name, later DFS parsing can advance beyond the end of the path.\\n\\nValidate PathConsumed against the search name length before storing it in\\nthe parsed referral.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/client/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"bfebe5110fd135d86d65a0a346e14c106b02028b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"5b439f39f33ec15d319ced3b025e122346fba987\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"285bd4a5f3f156aa5869843b47a1b1380b774241\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"2fdd6d196c656b376cc251e1e9ff110b3ed522e1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"9f88a99ed511651b2dc2177d6854b2d1b8322e75\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4ecce920e13ace16a5ba45efe8909946c28fb2ad\",\"lessThan\":\"f6f5ee2aa33b350c671721b965251c42cebb962e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/client/misc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/285bd4a5f3f156aa5869843b47a1b1380b774241\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2fdd6d196c656b376cc251e1e9ff110b3ed522e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5b439f39f33ec15d319ced3b025e122346fba987\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9f88a99ed511651b2dc2177d6854b2d1b8322e75\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bfebe5110fd135d86d65a0a346e14c106b02028b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f6f5ee2aa33b350c671721b965251c42cebb962e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-09T22:37:07+00:00",
      "cve": "CVE-2026-68343",
      "id": "CVE-2026-68343",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:fixed": "457",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "44",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smb: client: validate DFS referral PathConsumed",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68343.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:35:55Z",
      "cve": "CVE-2026-68343",
      "id": "CVE-2026-68343",
      "initial_release_date": "2026-08-11T23:47:07Z",
      "product_status:first_fixed": "65",
      "product_status:known_affected": "743",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "103",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68343",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68343.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.