In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix buffer overflow when parsing NFS reparse points
ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength.
Function cifsstrndupfrom_utf16() is currentlly accessing buf->DataBuffer at position after the end of the buffer because it does not subtract InodeType size from the length. Fix this problem and correctly subtract variable len.
Member InodeType is present only when reparse buffer is large enough. Check for ReparseDataLength before accessing InodeType to prevent another invalid memory access.
Major and minor rdev values are present also only when reparse buffer is large enough. Check for reparse buffer size before calling reparse_mkdev().
[
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-03051446",
        "signature_type": "Function",
        "digest": {
            "length": 1341.0,
            "function_hash": "274095417313459197569327576737951740541"
        },
        "target": {
            "file": "fs/smb/client/reparse.c",
            "function": "cifs_reparse_point_to_fattr"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@803b3a39cb096d8718c0aebc03fd19f11c7dc919",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-0691cf46",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "36972891602766573551882086302339936731",
                "278066986384965593417883122750029776440",
                "233245193809455538303071914790927734650",
                "33209552435181120772740139327164182045",
                "271615132156317380757117077525723353610",
                "48966202593408704773086494879686148988",
                "218150032340757688032517695600242254970",
                "158467974880642177861204974958568846447",
                "270130639657873453060510731846233773557",
                "303451824033140726130293020531707812919",
                "47040974480128690690082762146820800149",
                "263196507845809731051338171348023574505",
                "321055370045669579093997336777039364989",
                "242160008481516262720911239098070756234",
                "40725430928707478760101948649985531849",
                "140881608221661211901246164649950750525"
            ]
        },
        "target": {
            "file": "fs/smb/client/reparse.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6db81c550cea0c73bd72ef55f579991e0e4ba07",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-06bade36",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "322010191910039425307711954886206633798",
                "101923106393166191874368500319364278185",
                "175125705668016528306666253419388182279",
                "259578523632281592705112565487258635291"
            ]
        },
        "target": {
            "file": "fs/smb/client/smb2ops.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec79e6170bcae8a6036a4b6960f5e7e59a785601",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-111a12c8",
        "signature_type": "Function",
        "digest": {
            "length": 1369.0,
            "function_hash": "90686002013004181946237765503149531497"
        },
        "target": {
            "file": "fs/smb/client/reparse.c",
            "function": "cifs_reparse_point_to_fattr"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a8910af01653c1c268984855629d71fb81f404",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-188b66b1",
        "signature_type": "Function",
        "digest": {
            "length": 742.0,
            "function_hash": "9656927425627233384488313647112840608"
        },
        "target": {
            "file": "fs/smb/client/reparse.c",
            "function": "parse_reparse_posix"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@803b3a39cb096d8718c0aebc03fd19f11c7dc919",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-27a9d5d4",
        "signature_type": "Function",
        "digest": {
            "length": 1341.0,
            "function_hash": "274095417313459197569327576737951740541"
        },
        "target": {
            "file": "fs/smb/client/reparse.c",
            "function": "cifs_reparse_point_to_fattr"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c173d47b69f07cd7ca08efb4e458adbd4725d8e9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-320ecf4d",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "322010191910039425307711954886206633798",
                "101923106393166191874368500319364278185",
                "175125705668016528306666253419388182279",
                "259578523632281592705112565487258635291"
            ]
        },
        "target": {
            "file": "fs/cifs/smb2ops.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b222d6cb87077faf56a687a72af1951cf78c8a9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-575a9f15",
        "signature_type": "Function",
        "digest": {
            "length": 742.0,
            "function_hash": "9656927425627233384488313647112840608"
        },
        "target": {
            "file": "fs/smb/client/reparse.c",
            "function": "parse_reparse_posix"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a8910af01653c1c268984855629d71fb81f404",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-64e6280e",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "322010191910039425307711954886206633798",
                "101923106393166191874368500319364278185",
                "175125705668016528306666253419388182279",
                "259578523632281592705112565487258635291"
            ]
        },
        "target": {
            "file": "fs/cifs/smb2ops.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73b078e3314d4854fd8286f3ba65c860ddd3a3dd",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-7f2ac976",
        "signature_type": "Function",
        "digest": {
            "length": 562.0,
            "function_hash": "141610767396401703682447494895377768863"
        },
        "target": {
            "file": "fs/cifs/smb2ops.c",
            "function": "parse_reparse_posix"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b222d6cb87077faf56a687a72af1951cf78c8a9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-97eb97a4",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "36972891602766573551882086302339936731",
                "278066986384965593417883122750029776440",
                "233245193809455538303071914790927734650",
                "33209552435181120772740139327164182045",
                "271615132156317380757117077525723353610",
                "48966202593408704773086494879686148988",
                "218150032340757688032517695600242254970",
                "158467974880642177861204974958568846447",
                "270130639657873453060510731846233773557",
                "303451824033140726130293020531707812919",
                "47040974480128690690082762146820800149",
                "263196507845809731051338171348023574505",
                "321055370045669579093997336777039364989",
                "242160008481516262720911239098070756234",
                "40725430928707478760101948649985531849",
                "140881608221661211901246164649950750525"
            ]
        },
        "target": {
            "file": "fs/smb/client/reparse.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@803b3a39cb096d8718c0aebc03fd19f11c7dc919",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-b65b6485",
        "signature_type": "Function",
        "digest": {
            "length": 742.0,
            "function_hash": "9656927425627233384488313647112840608"
        },
        "target": {
            "file": "fs/smb/client/reparse.c",
            "function": "parse_reparse_posix"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c173d47b69f07cd7ca08efb4e458adbd4725d8e9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-b9885418",
        "signature_type": "Function",
        "digest": {
            "length": 562.0,
            "function_hash": "141610767396401703682447494895377768863"
        },
        "target": {
            "file": "fs/cifs/smb2ops.c",
            "function": "parse_reparse_posix"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01cdddde39b065074fd48f07027757783cbf5b7d",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-bd37c824",
        "signature_type": "Function",
        "digest": {
            "length": 1341.0,
            "function_hash": "274095417313459197569327576737951740541"
        },
        "target": {
            "file": "fs/smb/client/reparse.c",
            "function": "cifs_reparse_point_to_fattr"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6db81c550cea0c73bd72ef55f579991e0e4ba07",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-bed38a45",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "322010191910039425307711954886206633798",
                "101923106393166191874368500319364278185",
                "175125705668016528306666253419388182279",
                "259578523632281592705112565487258635291"
            ]
        },
        "target": {
            "file": "fs/cifs/smb2ops.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@01cdddde39b065074fd48f07027757783cbf5b7d",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-c16e4150",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "36972891602766573551882086302339936731",
                "278066986384965593417883122750029776440",
                "233245193809455538303071914790927734650",
                "33209552435181120772740139327164182045",
                "271615132156317380757117077525723353610",
                "48966202593408704773086494879686148988",
                "218150032340757688032517695600242254970",
                "158467974880642177861204974958568846447",
                "270130639657873453060510731846233773557",
                "303451824033140726130293020531707812919",
                "157431926086693349305318825828366551565",
                "238585908840481997604828601332846704840",
                "292901181561361669655164492049385253134",
                "309350557930367488764210799935939996120",
                "283353104503238202542145537478882986038",
                "154876353625594149683622155645340180001"
            ]
        },
        "target": {
            "file": "fs/smb/client/reparse.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a8910af01653c1c268984855629d71fb81f404",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-ce336519",
        "signature_type": "Function",
        "digest": {
            "length": 562.0,
            "function_hash": "141610767396401703682447494895377768863"
        },
        "target": {
            "file": "fs/cifs/smb2ops.c",
            "function": "parse_reparse_posix"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73b078e3314d4854fd8286f3ba65c860ddd3a3dd",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-d32e5da9",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "36972891602766573551882086302339936731",
                "278066986384965593417883122750029776440",
                "233245193809455538303071914790927734650",
                "33209552435181120772740139327164182045",
                "271615132156317380757117077525723353610",
                "48966202593408704773086494879686148988",
                "218150032340757688032517695600242254970",
                "158467974880642177861204974958568846447",
                "270130639657873453060510731846233773557",
                "303451824033140726130293020531707812919",
                "47040974480128690690082762146820800149",
                "263196507845809731051338171348023574505",
                "321055370045669579093997336777039364989",
                "242160008481516262720911239098070756234",
                "40725430928707478760101948649985531849",
                "140881608221661211901246164649950750525"
            ]
        },
        "target": {
            "file": "fs/smb/client/reparse.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c173d47b69f07cd7ca08efb4e458adbd4725d8e9",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-e4b6e087",
        "signature_type": "Function",
        "digest": {
            "length": 742.0,
            "function_hash": "9656927425627233384488313647112840608"
        },
        "target": {
            "file": "fs/smb/client/reparse.c",
            "function": "parse_reparse_posix"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6db81c550cea0c73bd72ef55f579991e0e4ba07",
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "id": "CVE-2024-49996-fbe317fc",
        "signature_type": "Function",
        "digest": {
            "length": 562.0,
            "function_hash": "141610767396401703682447494895377768863"
        },
        "target": {
            "file": "fs/smb/client/smb2ops.c",
            "function": "parse_reparse_posix"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec79e6170bcae8a6036a4b6960f5e7e59a785601",
        "deprecated": false
    }
]