CVE-2026-97560 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems who need to verify affected versions, apply remediation through kernel updates, and monitor Linux kernel security patches. This includes security teams responsible for vulnerability management, operators managing Linux-based systems, and platform administrators who need to ensure the security and integrity of their systems.

Why it matters

A one-byte out-of-bounds read vulnerability in the Linux kernel's smb2_parse_native_symlink function requires verification of affected versions, remediation through kernel updates, and monitoring of Linux kernel security patches.

• Potential information disclosure through out-of-bounds read
• Requires verification of affected Linux kernel versions
• Remediation priority for Linux kernel updates
• Monitoring and patching of Linux kernel vulnerabilities

Technical summary

The smb2_parse_native_symlink function in the Linux kernel incorrectly calculates the length of a share-root relative native symlink, leading to a one-byte out-of-bounds read vulnerability. This issue was resolved by fixing the length calculation in the smb2_parse_native_symlink function. The vulnerability was identified through a KASAN splat, indicating a potential information disclosure risk. Affected Linux kernel versions require verification and remediation through kernel updates. The fix involves updating the kernel to correctly handle the length of share-root relative native symlinks.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to fix the vulnerability
• Monitor Linux kernel updates for potential security patches
• Consider implementing additional security measures to protect against potential exploitation
• Verify affected Linux kernel versions and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was discovered through a KASAN splat when accessing an SMB symlink with a target of 'a' 'b'. The issue was resolved by fixing the length calculation in the smb2_parse_native_symlink function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.