CVE-2026-68343: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68343 is a memory disclosure vulnerability in the Linux kernel's SMB client DFS referral parsing code. The parse_dfs_referrals() function fails to validate the PathConsumed value from DFS referral responses against the search name length, allowing a malformed response to cause out-of-bounds buffer access. The vulnerability affects Linux kernel versions from 4.11 onward, with fixes backported to stable branches 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, and mainline 7.2. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) in the parse_dfs_referrals() function within the Linux kernel's SMB client. While the function validates the fixed referral entry array and per-referral string offsets, it does not validate the PathConsumed field in the DFS referral response against the length of the search name. An attacker controlling an SMB server can craft a malformed DFS referral response with an oversized PathConsumed value, causing subsequent DFS path parsing to read beyond the end of the allocated path buffer — resulting in an out-of-bounds memory read. No authentication is required, as the malicious response can be delivered over the network to any Linux client that initiates a DFS referral lookup (GitHub Advisory).

Successful exploitation allows an unauthenticated network attacker to read sensitive data from kernel memory (confidentiality impact) or trigger a denial of service by causing the kernel to access invalid memory (availability impact). The vulnerability has no integrity impact. Because the affected code runs in kernel context, leaked memory may contain credentials, cryptographic material, or other sensitive kernel data, and a crash could render the affected system unavailable (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.175%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection coverage exists via Qualys (IDs 6285481, 919734) and Nessus (ID 338722) (GitHub Advisory).

Update the Linux kernel to a patched version: 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2 (mainline). The fix adds validation of the PathConsumed value against the search name length before storing it in the parsed referral structure. As a workaround where patching is not immediately possible, disabling SMB DFS client functionality or blocking outbound SMB traffic to untrusted servers can reduce exposure. Red Hat has issued RHSA-2026:57252 addressing this vulnerability (Red Hat Advisory, GitHub Advisory).

Red Hat issued a security errata (RHSA-2026:57252) addressing this vulnerability, and Oracle Linux published a corresponding advisory (ELSA-2026-57252). Tenable added detection plugins (Nessus IDs 338239 and 338679) shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified (Red Hat Advisory).