{"id":"CVE-2026-68343","title":"smb: client: validate DFS referral PathConsumed","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate DFS referral PathConsumed\n\nparse_dfs_referrals() validates that the response contains the fixed\nreferral entry array and, on for-next, the per-ref…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < bfebe5110fd135d86d65a0a346e14c106b02028b","Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 5b439f39f33ec15d319ced3b025e122346fba987","Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 285bd4a5f3f156aa5869843b47a1b1380b774241","Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 2fdd6d196c656b376cc251e1e9ff110b3ed522e1","Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 9f88a99ed511651b2dc2177d6854b2d1b8322e75","Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < f6f5ee2aa33b350c671721b965251c42cebb962e","Linux 4.11"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:47:19.145050Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:08.866Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68343","references":[{"url":"https://git.kernel.org/stable/c/bfebe5110fd135d86d65a0a346e14c106b02028b"},{"url":"https://git.kernel.org/stable/c/5b439f39f33ec15d319ced3b025e122346fba987"},{"url":"https://git.kernel.org/stable/c/285bd4a5f3f156aa5869843b47a1b1380b774241"},{"url":"https://git.kernel.org/stable/c/2fdd6d196c656b376cc251e1e9ff110b3ed522e1"},{"url":"https://git.kernel.org/stable/c/9f88a99ed511651b2dc2177d6854b2d1b8322e75"},{"url":"https://git.kernel.org/stable/c/f6f5ee2aa33b350c671721b965251c42cebb962e"}],"tags":["cve.org"],"epss":0.00513,"epssPercentile":0.42408,"ingestedAt":"2026-10-16T17:24:46.861Z","slug":"CVE-2026-68343","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate DFS referral PathConsumed\n\nparse_dfs_referrals() validates that the response contains the fixed\nreferral entry array and, on for-next, the per-referral string offsets.\nHowever, the response also contains a PathConsumed value that is later\nused for DFS path parsing.\n\nIf a malformed response provides a PathConsumed value larger than the\nsearch name, later DFS parsing can advance beyond the end of the path.\n\nValidate PathConsumed against the search name length before storing it in\nthe parsed referral.\n\n## Affected\n\n- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < bfebe5110fd135d86d65a0a346e14c106b02028b`\n- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 5b439f39f33ec15d319ced3b025e122346fba987`\n- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 285bd4a5f3f156aa5869843b47a1b1380b774241`\n- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 2fdd6d196c656b376cc251e1e9ff110b3ed522e1`\n- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < 9f88a99ed511651b2dc2177d6854b2d1b8322e75`\n- `Linux >= 4ecce920e13ace16a5ba45efe8909946c28fb2ad < f6f5ee2aa33b350c671721b965251c42cebb962e`\n- `Linux 4.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}