CVE-2026-43112 Overview
CVE-2026-43112 is an out-of-bounds read vulnerability in the Linux kernel's SMB client implementation. The flaw resides in the cifs_sanitize_prepath function within fs/smb/client. When the function receives an empty string or a string containing only delimiters such as /, the existing logic dereferences *(cursor2 - 1) before cursor2 has advanced past the buffer start. This produces a read beyond the intended memory boundary. The bug was identified through manual code audit and confirmed with a standalone AddressSanitizer test case that triggered a segmentation fault on affected inputs. Linux kernel maintainers have merged a fix that adds an early exit check after stripping prepended delimiters, returning NULL when no path content remains.
Critical Impact
An out-of-bounds read in the CIFS client path sanitization routine can lead to kernel memory disclosure or denial of service when malformed prefix paths are processed.
Affected Products
- Linux kernel SMB/CIFS client subsystem (fs/smb/client)
- Multiple stable kernel branches addressed by commits 2d29214, 49b1ce6, 5d4fe46, 78ec5bf, and 86f9c23
- Systems mounting SMB/CIFS shares with prefix path options
Discovery Timeline
- 2026-05-06 - CVE-2026-43112 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43112
Vulnerability Analysis
The vulnerability is an out-of-bounds read triggered inside cifs_sanitize_prepath, a helper that normalizes prefix paths supplied during SMB share mounts. The function uses two cursor pointers to walk and rewrite the input string, removing leading delimiter characters. When the caller supplies an empty string or a path that consists entirely of delimiters such as "/", the loop advancing cursor2 never executes. The subsequent boundary check then evaluates *(cursor2 - 1), reading one byte before the start of the buffer. This memory access falls outside the legitimate allocation and constitutes a classic out-of-bounds read.
Root Cause
The root cause is a missing precondition check after the delimiter-stripping step. The original code assumed cursor2 had advanced past at least one character before performing pointer arithmetic of the form cursor2 - 1. When all input characters are stripped, that assumption fails. The corrected logic adds an early exit: if no path content remains after stripping, the function returns NULL instead of dereferencing the invalid pointer.
Attack Vector
Reaching the vulnerable code path requires control over the prefix path argument passed to the CIFS mount logic. A local user with permission to mount CIFS shares, or a process supplying mount parameters through automated mounting infrastructure, can submit an empty or delimiter-only prefix path. The out-of-bounds read may disclose adjacent kernel memory contents to logs or trigger faults under memory sanitizers and hardened kernels. The vulnerability does not provide a direct write primitive. See the upstream fixes in Linux Kernel Commit 86f9c23 and Linux Kernel Commit 2d29214 for the exact code change.
Detection Methods for CVE-2026-43112
Indicators of Compromise
- Kernel log entries referencing faults inside cifs_sanitize_prepath or the surrounding CIFS mount path
- KASAN or AddressSanitizer reports flagging out-of-bounds reads in fs/smb/client during mount operations
- Unexpected SIGSEGV or kernel oops events correlated with CIFS mount attempts using empty or /-only prefix paths
Detection Strategies
- Audit kernel versions across Linux fleets and compare against the patched commits referenced by upstream stable trees
- Enable KASAN on test kernels to surface out-of-bounds reads in CIFS code paths during fuzzing or QA
- Review mount audit logs for CIFS operations that include suspicious or malformed prefixpath parameters
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log to a centralized log platform and alert on CIFS-related warnings or oops messages
- Track invocation of the mount.cifs binary with command-line arguments using auditd or eBPF-based telemetry
- Monitor for repeated mount failures from the same user or service account, which may indicate probing activity
How to Mitigate CVE-2026-43112
Immediate Actions Required
- Apply the upstream Linux kernel patches that introduce the early exit check in cifs_sanitize_prepath
- Rebuild and redeploy distribution kernels once vendor backports become available
- Restrict the ability to mount arbitrary CIFS shares to trusted administrators where feasible
Patch Information
The fix is delivered through five upstream commits to the Linux stable trees: Linux Kernel Commit 2d29214, Linux Kernel Commit 49b1ce6, Linux Kernel Commit 5d4fe46, Linux Kernel Commit 78ec5bf, and Linux Kernel Commit 86f9c23. The patch validates that path content remains after delimiter stripping and returns NULL if it does not.
Workarounds
- Avoid passing empty or delimiter-only prefixpath values when mounting CIFS shares
- Disable or restrict the cifs.ko kernel module on systems that do not require SMB client functionality
- Use mount-time validation in automation tooling to reject malformed prefix path arguments before they reach the kernel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
