8.8
Élevée
CVE-2026-43112 In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in…
Description
In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read. This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL. The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Linux 7.0 | premières → < 7.0 | 7.0 |
| Linux 6.19 | premières → < 6.19.14 | 6.19.14 |
| Linux 6.18 | premières → < 6.18.24 | 6.18.24 |
| Linux 6.12 | premières → < 6.12.83 | 6.12.83 |
| Linux 6.6 | premières → < 6.6.136 | 6.6.136 |
| Linux 6.1 | premières → < 6.1.175 | 6.1.175 |
| Linux | 5.16 | Pas de correctif indiqué |
| Linux 5.15 | premières → < 5.15.209 | 5.15.209 |
| Red Hat Enterprise Linux 10 | Versions non publiées |
Afficher les 38 autres branches Masquer les 38 autres branches
Autres CVE de Linux
Les 18300 CVE de Linux →
CVE-2026-99284
net: skbuff: propagate shared-frag marker in skb_zerocopy()
Non notée
CVE-2026-99283
netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
Non notée
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop
Non notée
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration
Non notée