CVE-2026-72318

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

A remote malicious SMB/DFS server delivers the malformed DFS referral reply over the network when the CIFS client issues FSCTL_DFS_GET_REFERRALS (SMB2) or TRANS2_GET_DFS_REFERRAL (SMB1); no local or physical access is required to reach parse_dfs_referrals().

AC:LAttack complexity, low

Once a client session exists, the attacker fully controls referral header fields and per-entry DfsPathOffset/NetworkAddressOffset in the reply; no races, timing, or victim-specific memory layout are needed to trigger the out-of-bounds read reliably.

PR:NPrivileges required, none

Exploitation requires no privileges on the victim host—the attacker only needs to operate the SMB server returning the malicious DFS referral; the client kernel parses the response regardless of which local user triggered the referral lookup.

UI:NUser interaction, none

After a DFS CIFS mount or autofs/enterprise logon mount, referral lookups and periodic dfs_cache_refresh work run automatically on file access and reconnect without any additional deliberate user action beyond normal SMB/DFS client use.

S:UScope, unchanged

The flaw corrupts/confidentiality-impacts kernel memory in the same security authority as the CIFS client; it does not by itself cross a hypervisor, IOMMU, or container sandbox boundary distinct from standard kernel compromise.

C:HConfidentiality impact, high

Unvalidated string offsets let DfsPath/NetworkAddress pointers sit past the response buffer; the resulting negative max_len is cast to size_t for kstrndup()/strnlen(), enabling large out-of-bounds reads of adjacent kernel memory (SMB1/non-Unicode path).

I:LIntegrity impact, low

The bug is an out-of-bounds read that copies attacker-influenced kernel bytes into newly allocated heap buffers rather than an arbitrary write primitive, but heap contents are modified beyond the intended referral data scope.

A:HAvailability impact, high

Reading past the SMB response buffer can oops/panic the kernel on unmapped pages, and casting a negative max_len to size_t can drive very large strnlen()/allocation attempts, causing severe denial of service on servers and workstations using DFS mounts.