CVE-2026-68343: Linux Kernel Path Traversal Vulnerability

CVE-2026-68343 Overview

CVE-2026-68343 is an out-of-bounds read vulnerability in the Linux kernel's SMB client DFS (Distributed File System) referral parsing logic. The flaw resides in the parse_dfs_referrals() function, which validates fixed referral entry arrays and per-referral string offsets but fails to validate the PathConsumed field returned by the server. A malicious or malformed SMB server response can supply a PathConsumed value larger than the search name length, causing subsequent DFS path parsing to advance beyond the end of the path buffer.

Critical Impact
A remote SMB server can trigger out-of-bounds memory access in the kernel SMB client, leading to information disclosure or kernel crash (denial of service).

Affected Products

Linux kernel SMB client (fs/smb/client)
Systems mounting remote SMB shares that traverse DFS namespaces
Distributions shipping affected kernel versions prior to the referenced stable commits

Discovery Timeline

2026-08-10 - CVE-2026-68343 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68343

Vulnerability Analysis

The Linux kernel SMB client uses parse_dfs_referrals() to process DFS referral responses returned by remote SMB servers. The function verifies that the response contains the fixed referral entry array and, in its iteration loop, checks per-referral string offsets. However, the response also includes a PathConsumed value describing how many bytes of the requested path the server resolved. This value is later consumed during DFS path parsing to advance an internal pointer.

Before the patch, parse_dfs_referrals() stored PathConsumed in the parsed referral without comparing it against the length of the search name provided by the client. When a malicious server returns a PathConsumed value larger than the search name buffer, downstream DFS path parsing walks past the end of the buffer. The result is an out-of-bounds read of kernel memory, which can leak data or corrupt parsing state and crash the kernel.

Root Cause

The root cause is missing input validation on server-supplied data. The client trusts the PathConsumed field from the SMB response without bounding it against the client-known search name length. This is a classic input validation error in a network-facing kernel parser and aligns with the Out-of-Bounds Read weakness class.

Attack Vector

Exploitation requires a Linux client to connect to an attacker-controlled or compromised SMB server and traverse a DFS referral. The attack is network-based, requires no privileges on the client, and no user interaction beyond initiating or maintaining an SMB mount that follows DFS referrals. Malicious middleboxes performing SMB man-in-the-middle attacks against unsigned or downgraded sessions can also inject crafted referral responses.

No public proof-of-concept exploit is available at the time of publication. The vulnerability is described in the upstream kernel commits referenced by the Kernel Git Commit 285bd4a and companion stable backports.

Detection Methods for CVE-2026-68343

Indicators of Compromise

Unexpected kernel oops or panic traces referencing parse_dfs_referrals, cifs, or smb modules in dmesg and /var/log/kern.log.
SMB mounts to untrusted or unfamiliar servers, particularly those returning DFS referrals from unexpected network ranges.
Repeated SMB session resets or client disconnects immediately after DFS referral requests.

Detection Strategies

Inventory Linux hosts running vulnerable kernel builds and correlate with hosts that mount SMB/CIFS shares using DFS.
Inspect SMB traffic for TRANS2 GET_DFS_REFERRAL responses where the PathConsumed value exceeds the requested path length.
Alert on kernel warnings or KASAN reports from CIFS code paths in environments where kernel debugging is enabled.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and create rules matching cifs, smb, or dfs fault signatures.
Monitor outbound SMB (TCP/445) connections from Linux servers to identify unauthorized DFS traversal targets.
Track kernel package versions across the fleet to detect hosts missing the referenced stable backports.

How to Mitigate CVE-2026-68343

Immediate Actions Required

Apply the latest stable Linux kernel updates from your distribution vendor that include the parse_dfs_referrals()PathConsumed validation fix.
Restrict SMB client connections to trusted, authenticated servers using host-based firewall rules on TCP/445.
Disable automatic DFS traversal on hosts that do not require it, or unmount SMB shares from untrusted namespaces until patches are deployed.

Patch Information

The fix validates PathConsumed against the search name length before storing it in the parsed referral. Upstream and stable patches are available at Kernel Git Commit 285bd4a, Kernel Git Commit 2fdd6d1, Kernel Git Commit 5b439f3, Kernel Git Commit 9f88a99, and Kernel Git Commit f6f5ee2. Rebuild or update kernels from your distribution once these commits are included.

Workarounds

Require SMB signing and encryption to reduce the risk of injected DFS referral responses from network attackers.
Block outbound SMB traffic to untrusted networks at the perimeter and enforce egress filtering on TCP/445.
Where DFS is not required, mount shares with the nodfs option to avoid triggering the vulnerable code path.

bash

# Example: mount an SMB share without following DFS referrals
mount -t cifs //fileserver.example.com/share /mnt/share \
  -o username=svc_backup,sec=ntlmsspi,seal,nodfs

# Example: block outbound SMB to untrusted networks
iptables -A OUTPUT -p tcp --dport 445 -d 0.0.0.0/0 -j DROP
iptables -A OUTPUT -p tcp --dport 445 -d 10.0.0.0/8 -j ACCEPT