CVE-2026-43112 Details
Description
In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read. This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL. The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.
A vulnerability in the Linux kernel's CIFS (Common Internet File System) client has been addressed, which involved an out-of-bounds read error. This issue occurred in the 'cifs_sanitize_prepath' function when it processed an empty string or a string made up solely of delimiters, such as '/'. The flaw arose because the function attempted to access a memory location before it had properly advanced the cursor, leading to an invalid memory read. The vulnerability was discovered through a manual code audit and confirmed with a standalone test case that, when compiled with AddressSanitizer, caused a segmentation fault on the affected inputs.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-125 | Out-of-bounds Read | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.16.1, < 6.6.136 >= 6.7, < 6.12.83 >= 6.13, < 6.18.24 >= 6.19, < 6.19.14 5.16 - 5.16 rc6 5.16 rc7 5.16 rc8 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 |
CPE
Remediation
| |
Change History
25 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | redhat-SADP |
| Sep 17, 2026 | CVE Modified | redhat-SADP |
| Sep 15, 2026 | CVE Modified | redhat-SADP |
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 4, 2026 | CVE Modified | redhat-SADP |
| Sep 3, 2026 | CVE Modified | redhat-SADP |
| Sep 2, 2026 | CVE Modified | redhat-SADP |
| Aug 27, 2026 | CVE Modified | redhat-SADP |
| Aug 26, 2026 | CVE Modified | redhat-SADP |
| Aug 26, 2026 | CVE Modified | kernel.org |
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 19, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Aug 10, 2026 | CVE Modified | redhat-SADP |
| Jul 22, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 8, 2026 | CVE Modified | redhat-SADP |
| Jul 7, 2026 | CVE Modified | redhat-SADP |
| Jul 3, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | CVE Modified | kernel.org |
| May 6, 2026 | New CVE Received | kernel.org |