CVE-2026-98168

A moderate out-of-bounds read flaw was found in the Linux kernel SMB client as shipped in newer Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams. In cifs_query_reparse_point(), when processing a query reparse point response, the client validates only that the computed start pointer lies within the response buffer; it does not verify that the 8 bytes required for the fixed reparse_data_buffer header remain. A malicious or compromised SMB server can return a crafted response whose DataOffset leaves fewer than 8 bytes remaining, causing the client to read the ReparseTag and ReparseDataLength fields out of bounds. This can crash the kernel, resulting in a denial of service, and may in principle expose out-of-bounds memory contents, although no direct information disclosure is demonstrated. Exploitation requires the client to connect to and query reparse points from an attacker-controlled or compromised SMB server, which is reflected in the Moderate rating (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code was introduced by downstream backports into recent streams only: RHEL 9.8, 9.9, and 9.10, RHEL 10.2, 10.3, and 10.4, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.22, 4.23, 5.0, and 5.1 are affected. Older streams, including RHEL 6, 7, and 8, RHEL 9.2, 9.4, and 9.6, and RHEL 10.0, do not contain the vulnerable code and are not affected. The fix is currently deferred for the affected streams and will be addressed in a future update rather than an immediate erratum; until a fix is released, the residual risk is a kernel crash (denial of service) on systems that mount or access SMB shares from untrusted servers.