CVE-2026-98169

An out-of-bounds read in the Linux kernel SMB client's snapshot enumeration results in a moderate-impact information disclosure affecting Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the RHEL CoreOS kernels shipped with OpenShift Container Platform. When a local user enumerates snapshots on a mounted SMB share, smb3_enum_snapshots() sets the reply data length to the 12-byte size of struct smb_snapshot_array without validating the actual length of the server's response. Because SMB2_ioctl() allocates the return buffer to exactly the server-supplied output count, a malicious or compromised SMB server (or an attacker able to intercept SMB traffic) can return an abnormally short reply, causing the subsequent copy_to_user() to read past the end of the buffer and disclose a small amount of adjacent kernel slab memory to the calling local user's process. The flaw does not modify memory or cause a crash.

Red Hat rates this flaw Moderate severity, lower than the upstream CVE.org Important rating (CVSS 7.1), because exploitation requires a local user on a system with an SMB share mounted from a rogue server (or whose SMB traffic is intercepted), and the disclosure is limited to a few bytes of adjacent kernel slab memory, which at worst could assist in attempts to defeat kernel address space layout randomization.

RHEL 8, 9, and 10 kernels (including kernel-rt), Red Hat In-Vehicle OS 2 kernels, and the RHEL CoreOS 8/9 kernels shipped in OpenShift Container Platform 4.12 and later are affected, with the fix deferred to a future scheduled update given the moderate severity and limited practical exploitability of the flaw. RHEL 6 and 7 ELS kernel and kernel-rt are not affected because the vulnerable code is not present in those streams. The residual risk of deferral is the small kernel memory disclosure described above, limited to systems where local users can access SMB mounts backed by untrusted servers.