Out-of-bounds read in Linux kernel SMB client symlink error response parsing

CVE-2026-31613 is an out-of-bounds read in the Linux kernel SMB client when parsing SMB 3.1.1 symlink error responses from an untrusted server. The vulnerable path is reached when an SMB CREATE request returns STATUS_STOPPED_ON_SYMLINK. In this path, smb2_check_message() returns success without performing length validation, leaving subsequent symlink parsing code to process attacker-controlled response data. In symlink_data(), SMB 3.1.1 error contexts are iterated with the loop condition "p < end", but the parser reads fields from the current context header before ensuring the full header fits in bounds. A server-controlled ErrorDataLength can advance the parser pointer to within 1-7 bytes of the end of the buffer, causing the next iteration to read past the end. Additionally, when a matching context is found, SymLinkErrorTag is read from ErrorContextData without verifying that the symlink header itself is fully present. A second bounds flaw exists in smb2_parse_symlink_response(), which validates the substitute name using SMB2_SYMLINK_STRUCT_SIZE as a fixed PathBuffer offset from iov_base. That offset is only correct when ErrorContextCount is 0; with one or more error contexts present, the actual symlink data is deeper in the buffer and may be shifted further by skipped contexts. As a result, substitute-name reads can run past iov_len and consume out-of-bounds heap bytes.