{"api_version":"1","generated_at":"2026-08-23T06:07:43+00:00","cve":"CVE-2026-72318","urls":{"html":"https://cve.report/CVE-2026-72318","api":"https://cve.report/api/cve/CVE-2026-72318.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72318","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72318"},"summary":{"title":"cifs: validate DFS referral string offsets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate DFS referral string offsets\n\nparse_dfs_referrals() validates that the response header and referral\narray fit in the received buffer, but each referral also contains string\noffsets supplied by the server.\n\nThose offsets are used to compute the DfsPath and NetworkAddress string\npointers without checking whether they still point inside the response\nbuffer. A malformed referral can therefore make the computed pointer\nexceed the end of the buffer. The resulting negative max_len is then\npassed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it\nto kstrndup() as a size_t, allowing strnlen() to read out of bounds.\n\nValidate each string offset before deriving the string pointer.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:04","updated_at":"2026-08-17 06:18:35"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.4","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.4","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","data":{"baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/b784cd1c24d89bf71be2efe1e948ff7c03371e57","name":"https://git.kernel.org/stable/c/b784cd1c24d89bf71be2efe1e948ff7c03371e57","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d64b6be5740ce230aca184d8d224c75d9866045d","name":"https://git.kernel.org/stable/c/d64b6be5740ce230aca184d8d224c75d9866045d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c37abc99bb3de3d3219ecef253d649f74117fd83","name":"https://git.kernel.org/stable/c/c37abc99bb3de3d3219ecef253d649f74117fd83","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/76c607b9353d377b1d1b11db50e743eee0ccf658","name":"https://git.kernel.org/stable/c/76c607b9353d377b1d1b11db50e743eee0ccf658","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/027a84ac6b50c12ef767c15abfc58aa865820e9e","name":"https://git.kernel.org/stable/c/027a84ac6b50c12ef767c15abfc58aa865820e9e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/929a85932d14190988f1eafd6ee8cc68d66ace0b","name":"https://git.kernel.org/stable/c/929a85932d14190988f1eafd6ee8cc68d66ace0b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72318","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72318","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4ecce920e13ace16a5ba45efe8909946c28fb2ad 76c607b9353d377b1d1b11db50e743eee0ccf658 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4ecce920e13ace16a5ba45efe8909946c28fb2ad d64b6be5740ce230aca184d8d224c75d9866045d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4ecce920e13ace16a5ba45efe8909946c28fb2ad 929a85932d14190988f1eafd6ee8cc68d66ace0b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4ecce920e13ace16a5ba45efe8909946c28fb2ad b784cd1c24d89bf71be2efe1e948ff7c03371e57 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4ecce920e13ace16a5ba45efe8909946c28fb2ad c37abc99bb3de3d3219ecef253d649f74117fd83 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4ecce920e13ace16a5ba45efe8909946c28fb2ad 027a84ac6b50c12ef767c15abfc58aa865820e9e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.11","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.178 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.145 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72318","cve":"CVE-2026-72318","epss":"0.005860000","percentile":"0.452350000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"76c607b9353d377b1d1b11db50e743eee0ccf658","status":"affected","version":"4ecce920e13ace16a5ba45efe8909946c28fb2ad","versionType":"git"},{"lessThan":"d64b6be5740ce230aca184d8d224c75d9866045d","status":"affected","version":"4ecce920e13ace16a5ba45efe8909946c28fb2ad","versionType":"git"},{"lessThan":"929a85932d14190988f1eafd6ee8cc68d66ace0b","status":"affected","version":"4ecce920e13ace16a5ba45efe8909946c28fb2ad","versionType":"git"},{"lessThan":"b784cd1c24d89bf71be2efe1e948ff7c03371e57","status":"affected","version":"4ecce920e13ace16a5ba45efe8909946c28fb2ad","versionType":"git"},{"lessThan":"c37abc99bb3de3d3219ecef253d649f74117fd83","status":"affected","version":"4ecce920e13ace16a5ba45efe8909946c28fb2ad","versionType":"git"},{"lessThan":"027a84ac6b50c12ef767c15abfc58aa865820e9e","status":"affected","version":"4ecce920e13ace16a5ba45efe8909946c28fb2ad","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/misc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.11"},{"lessThan":"4.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.178","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.145","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"4.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"4.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate DFS referral string offsets\n\nparse_dfs_referrals() validates that the response header and referral\narray fit in the received buffer, but each referral also contains string\noffsets supplied by the server.\n\nThose offsets are used to compute the DfsPath and NetworkAddress string\npointers without checking whether they still point inside the response\nbuffer. A malformed referral can therefore make the computed pointer\nexceed the end of the buffer. The resulting negative max_len is then\npassed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it\nto kstrndup() as a size_t, allowing strnlen() to read out of bounds.\n\nValidate each string offset before deriving the string pointer."}],"metrics":[{"cvssV3_1":{"baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - A remote malicious SMB/DFS server delivers the malformed DFS referral reply over the network when the CIFS client issues FSCTL_DFS_GET_REFERRALS (SMB2) or TRANS2_GET_DFS_REFERRAL (SMB1); no local or physical access is required to reach parse_dfs_referrals().\nAC:L - Once a client session exists, the attacker fully controls referral header fields and per-entry DfsPathOffset/NetworkAddressOffset in the reply; no races, timing, or victim-specific memory layout are needed to trigger the out-of-bounds read reliably.\nPR:N - Exploitation requires no privileges on the victim host—the attacker only needs to operate the SMB server returning the malicious DFS referral; the client kernel parses the response regardless of which local user triggered the referral lookup.\nUI:N - After a DFS CIFS mount or autofs/enterprise logon mount, referral lookups and periodic dfs_cache_refresh work run automatically on file access and reconnect without any additional deliberate user action beyond normal SMB/DFS client use.\nS:U - The flaw corrupts/confidentiality-impacts kernel memory in the same security authority as the CIFS client; it does not by itself cross a hypervisor, IOMMU, or container sandbox boundary distinct from standard kernel compromise.\nC:H - Unvalidated string offsets let DfsPath/NetworkAddress pointers sit past the response buffer; the resulting negative max_len is cast to size_t for kstrndup()/strnlen(), enabling large out-of-bounds reads of adjacent kernel memory (SMB1/non-Unicode path).\nI:L - The bug is an out-of-bounds read that copies attacker-influenced kernel bytes into newly allocated heap buffers rather than an arbitrary write primitive, but heap contents are modified beyond the intended referral data scope.\nA:H - Reading past the SMB response buffer can oops/panic the kernel on unmapped pages, and casting a negative max_len to size_t can drive very large strnlen()/allocation attempts, causing severe denial of service on servers and workstations using DFS mounts."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:42:44.209Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/76c607b9353d377b1d1b11db50e743eee0ccf658"},{"url":"https://git.kernel.org/stable/c/d64b6be5740ce230aca184d8d224c75d9866045d"},{"url":"https://git.kernel.org/stable/c/929a85932d14190988f1eafd6ee8cc68d66ace0b"},{"url":"https://git.kernel.org/stable/c/b784cd1c24d89bf71be2efe1e948ff7c03371e57"},{"url":"https://git.kernel.org/stable/c/c37abc99bb3de3d3219ecef253d649f74117fd83"},{"url":"https://git.kernel.org/stable/c/027a84ac6b50c12ef767c15abfc58aa865820e9e"}],"title":"cifs: validate DFS referral string offsets","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72318","datePublished":"2026-08-15T05:55:31.682Z","dateReserved":"2026-08-09T03:40:39.919Z","dateUpdated":"2026-08-17T05:42:44.209Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:04","lastModifiedDate":"2026-08-17 06:18:35","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.5}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72318","Ordinal":"1","Title":"cifs: validate DFS referral string offsets","CVE":"CVE-2026-72318","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72318","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate DFS referral string offsets\n\nparse_dfs_referrals() validates that the response header and referral\narray fit in the received buffer, but each referral also contains string\noffsets supplied by the server.\n\nThose offsets are used to compute the DfsPath and NetworkAddress string\npointers without checking whether they still point inside the response\nbuffer. A malformed referral can therefore make the computed pointer\nexceed the end of the buffer. The resulting negative max_len is then\npassed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it\nto kstrndup() as a size_t, allowing strnlen() to read out of bounds.\n\nValidate each string offset before deriving the string pointer.","Type":"Description","Title":"cifs: validate DFS referral string offsets"}]}}}