The Linux kernel's CIFS component had a vulnerability (CVE-2026-72318) where parse_dfs_referrals() validated the response header and referral array boundaries but failed to validate string offsets within each referral. These offsets are used to compute pointers to DfsPath and NetworkAddress strings without ensuring they remain inside the buffer. A malformed referral could cause these pointers to exceed the buffer's end, resulting in a negative max_len passed to cifs_strndup_from_utf16(), which then forwards it as a size_t to kstrndup(). This leads to strnlen() reading out of bounds, causing a potential memory safety issue. The fix involves validating each string offset before deriving the string pointer.

This vulnerability can cause out-of-bounds memory reads in kernel space, which may lead to information disclosure or kernel instability. No known exploits are reported in the wild. The impact is limited to the Linux kernel's CIFS DFS referral parsing functionality.

A fix has been implemented in the Linux kernel to validate string offsets properly in parse_dfs_referrals(). Users should update their Linux kernel to a version that includes this fix. Since no patch links or vendor advisories are provided, check the official Linux kernel release notes or security advisories for the fixed version. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.