{"id":"CVE-2026-43112","revision":"84d56656fd4b42c3893310462bcdbab4","records":[{"revision":"84d56656fd4b42c3893310462bcdbab4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43112","aliases":[],"title":"fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath\n\nWhen cifs_sanitize_prepath is called with an empty string or a string\ncontaining only delimiters (e.g., \"/\"), the current logic attempts to\ncheck *(cursor2 - 1) before cursor2 has advanced. This results in an\nout-of-bounds read.\n\nThis patch adds an early exit check after stripping prepended\ndelimiters. If no path content remains, the function returns NULL.\n\nThe bug was identified via manual audit and verified using a\nstandalone test case compiled with AddressSanitizer, which\ntriggered a SEGV on affected inputs.","state":0,"publishedAt":"2026-05-06T07:40:38.563+00:00","modifiedAt":"2026-10-19T19:06:13.909+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/fs_context.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c63433a09d6ae4c226fcbc66da4c58fc189fd746\",\n                            \"lessThan\": \"a2ba20c17de8eb028f96b1d85f119d3d25655bd9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a31080899d5fdafcccf7f39dd214a814a2c82626\",\n                            \"lessThan\": \"fbced33599653471b4581dfe1abc7b467031f126\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a31080899d5fdafcccf7f39dd214a814a2c82626\",\n                            \"lessThan\": \"5d4fe469fe7dbff7d874c196bb680a82f2625d95\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a31080899d5fdafcccf7f39dd214a814a2c82626\",\n                            \"lessThan\": \"2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a31080899d5fdafcccf7f39dd214a814a2c82626\",\n                            \"lessThan\": \"86f9c23e0814cfdffda9eedf0c591c51ba209010\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a31080899d5fdafcccf7f39dd214a814a2c82626\",\n                            \"lessThan\": \"49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a31080899d5fdafcccf7f39dd214a814a2c82626\",\n                            \"lessThan\": \"78ec5bf2f589ec7fd8f169394bfeca541b077317\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.15.11\",\n                            \"lessThan\": \"5.15.209\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/client/fs_context.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.209\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.175\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.136\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.83\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.24\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.14\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/a2ba20c17de8eb028f96b1d85f119d3d25655bd9","https://git.kernel.org/stable/c/fbced33599653471b4581dfe1abc7b467031f126","https://git.kernel.org/stable/c/5d4fe469fe7dbff7d874c196bb680a82f2625d95","https://git.kernel.org/stable/c/2d29214448ec0f4e7e18bb1c14dd4a6c07f1c439","https://git.kernel.org/stable/c/86f9c23e0814cfdffda9eedf0c591c51ba209010","https://git.kernel.org/stable/c/49b1ce6d7cfb6c5a49f68bf5ccfcfb6ba14e63c3","https://git.kernel.org/stable/c/78ec5bf2f589ec7fd8f169394bfeca541b077317"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43112","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43112","identifiers":["CVE-2026-43112"]},"retained":false,"historicalAffected":[]}],"coverage":[]}