CVE-2026-97563

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The SMB1 synchronous read helper function CIFSSMBRead() fails to validate the DataOffset value provided by the server. While the function checks DataLength against CIFSMaxBufSize and the caller's count, it does not verify if the range defined by DataOffset and DataLength remains within the actual response buffer received from the server. A malicious or compromised SMB1 server could provide a large DataOffset, causing the system to copy adjacent kernel heap memory into the read buffer, leading to information disclosure, or access unmapped memory, resulting in a denial of service. This issue is only reachable when an explicit vers=1.0 mount is used, as SMB1 is not negotiated by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid using an explicit vers=1.0 mount to prevent the use of the vulnerable SMB1 protocol.