CVE-2026-52967

smb/client: fix possible infinite loop and oob read in symlink_data()

State: Published
Severity: 8.1 High
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

smb/client: fix possible infinite loop and oob read in symlink_data()

On 32-bit architectures, the infinite loop is as follows:

len = p->ErrorDataLength == 0xfffffff8 u8 *next = p->ErrorContextData + len next == p

On 32-bit architectures, the out-of-bounds read is as follows:

len = p->ErrorDataLength == 0xfffffff0 u8 *next = p->ErrorContextData + len next == (u8 *)p - 8

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	76894f3e2f71177747b8b4763fb180e800279585 to before 1cfa2d59f669db28d6292d10ff87ca6837c781b0Affected 76894f3e2f71177747b8b4763fb180e800279585 to before b41598bf54b3fe528994e573df6008f8f4d0a4f4Affected 76894f3e2f71177747b8b4763fb180e800279585 to before cd4b9b662f0fb9aa97ee6bf9034eca76fc6cab23Affected 76894f3e2f71177747b8b4763fb180e800279585 to before 97a05b0ae9ea5ec052be2eef0f9cc7ce03501bbbAffected 76894f3e2f71177747b8b4763fb180e800279585 to before 1b9331b16b0ed9414dcf7583d8134bdfeb117aaeAffected 76894f3e2f71177747b8b4763fb180e800279585 to before 7d9a7f1f96cd617ee9e75bb22217c709038e26b8Affected 2d046892a493d9760c35fdaefc3017f27f91b621Affected 6.0.16 to before 6.1Affected
LinuxLinux	6.1Affected before 6.1Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

76894f3e2f71177747b8b4763fb180e800279585 to before 1cfa2d59f669db28d6292d10ff87ca6837c781b0Affected
76894f3e2f71177747b8b4763fb180e800279585 to before b41598bf54b3fe528994e573df6008f8f4d0a4f4Affected
76894f3e2f71177747b8b4763fb180e800279585 to before cd4b9b662f0fb9aa97ee6bf9034eca76fc6cab23Affected
76894f3e2f71177747b8b4763fb180e800279585 to before 97a05b0ae9ea5ec052be2eef0f9cc7ce03501bbbAffected
76894f3e2f71177747b8b4763fb180e800279585 to before 1b9331b16b0ed9414dcf7583d8134bdfeb117aaeAffected
76894f3e2f71177747b8b4763fb180e800279585 to before 7d9a7f1f96cd617ee9e75bb22217c709038e26b8Affected
2d046892a493d9760c35fdaefc3017f27f91b621Affected
6.0.16 to before 6.1Affected

LinuxLinux

6.1Affected
before 6.1Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.