CVE-2026-97560

A moderate impact flaw was found in the Linux kernel SMB client (fs/smb/client/reparse.c) in smb2_parse_native_symlink(). When parsing a share-root relative native symlink, the code copies from smb_target+1 to skip the leading separator but uses strlen(smb_target)+1 as the length, reading one byte past the allocated buffer. A malicious or compromised SMB server can supply a crafted symlink target (reparse point); when a local user or workload then accesses such a symlink on a mounted SMB share (for example via a stat or path lookup), the out-of-bounds read is triggered, which can crash the kernel and cause a denial of service. Only a single byte past the string terminator is read, and the Red Hat assessment found no evidence of information disclosure, so the impact is limited to availability (Red Hat CVSS 3.1: 5.5, MODERATE, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), despite the CVE description mentioning possible exposure of sensitive kernel memory. The vulnerable code was introduced into Red Hat kernels through a backport of the 'cifs: Fix parsing native symlinks relative to the export' change and is present only in newer streams; Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.2 and 9.4 update streams and their kernel-rt builds, and OpenShift Container Platform 4.12 through 4.18 are not affected because the vulnerable code is not present there. For the affected streams (Red Hat Enterprise Linux 9 versions 9.6 and later, Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.19 and later), the fix is deferred: this one-byte out-of-bounds read has a practical consequence of a local denial of service rather than memory corruption or privilege escalation, so it does not warrant an immediate out-of-cycle update and the fix will be delivered in a future scheduled kernel update. The residual risk is a kernel crash on systems where a user accesses a crafted native symlink on an SMB share served by a malicious server.