CVE-2026-98318 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
smb: client: validate absolute native symlink targets before NT fixups
With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying the target and calculating the print name length.
For "/ab", this causes two failures: sym[5] and path[5] are written
past their allocations, and plen -= 2 * poff subtracts an assumed 8-byte prefix from a 6-byte UTF-16 target, wrapping u16 plen to 65534. That underflow causes another overflow: memcpy() copies 65534 bytes into a 24-byte buffer. A user with write access to a mounted share can trigger these bugs with default settings.
Validate the NT drive prefix, including an ASCII drive letter, before accessing fixed offsets or subtracting the prefix length.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel SMB client implementation contains a critical memory corruption vulnerability arising from insufficient validation of absolute symbolic link targets during path resolution operations. This flaw specifically manifests when the symlinkroot configuration parameter is unset and the server returns an absolute native symlink target that lacks the expected NT-style drive prefix, such as a backslash-prefixed ASCII drive letter like C:. Under these conditions, the kernel code proceeds to copy the raw UTF-16 string without performing necessary conversion or validation steps. This oversight leads to a sequence of buffer overflows and integer underflows that can be exploited by any user with write access to a mounted SMB share using default configuration settings.
The technical root cause lies in the assumption that all absolute symlink targets will conform to a specific NT path format containing an eight-byte prefix representing the drive letter and separator characters. When this assumption is violated, subsequent code attempts to modify the target string at fixed offsets without verifying whether those offsets are within valid memory boundaries. Specifically, for a short absolute path like /ab, the kernel writes past the allocated bounds of sym[5] and path[5], resulting in heap-based buffer overflows. These out-of-bounds writes corrupt adjacent memory structures, potentially allowing an attacker to overwrite critical control data or execute arbitrary code depending on the layout of the affected kernel objects.
Following the initial buffer overflow, a secondary vulnerability emerges due to improper length calculation logic. The code subtracts an assumed eight-byte prefix length from the total path length variable, which is stored as an unsigned 16-bit integer. When applied to a short target string that does not contain this full prefix, the subtraction results in a significant underflow. For instance, subtracting eight bytes from a six-byte UTF-16 encoded target causes the value to wrap around to sixty-five thousand five hundred thirty-four. This erroneous large positive value is then passed directly as the length parameter to a memcpy function call.
The consequence of this integer underflow is a massive heap buffer overflow where the kernel attempts to copy over sixty-five thousand bytes into a destination buffer that was allocated for only twenty-four bytes. This extreme mismatch between source and destination sizes leads to severe memory corruption, potentially crashing the system or facilitating remote code execution if an attacker can control the content of the SMB share being accessed. The vulnerability highlights a dangerous pattern where input validation is skipped in favor of rigid structural assumptions about network protocol responses, leaving the kernel exposed to malformed data from untrusted servers.
From a classification perspective, this issue aligns with CWE-120 Buffer Copy without Checking Size of Input and CWE-190 Integer Underflow or Wraparound. The exploitation vector involves interacting with a mounted file system share, which maps to ATT&CK technique T1556 Modifying Authentication Process if the goal is privilege escalation via kernel compromise, though primarily it represents a local denial of service or code execution risk through network-accessible resources. Mitigation requires strict validation of incoming path components before processing them as fixed-format structures.
To resolve this vulnerability, developers must implement rigorous checks to verify that absolute symlink targets contain the expected NT drive prefix format before accessing specific character offsets or performing arithmetic operations on their lengths. This includes validating that an ASCII drive letter is present and correctly formatted in UTF-16 encoding. By ensuring that path components conform to anticipated structures prior to memory allocation and manipulation, the kernel can prevent both the out-of-bounds writes and the subsequent integer underflows that lead to catastrophic buffer overflows. System administrators should apply available kernel updates promptly to patch this flaw and restrict access to SMB shares until patches are deployed.