Out-of-bounds read in Linux kernel SMB client symlink error response parsing

CVE-2026-31613 is an out-of-bounds read vulnerability in the Linux kernel SMB client code when parsing SMB 3.1.1 symlink error responses from an untrusted server. The issue is triggered on the CREATE error path when the server returns STATUS_STOPPED_ON_SYMLINK. In that path, smb2_check_message() returns success without performing length validation, leaving subsequent symlink parsing logic to process attacker-controlled response data. In symlink_data(), SMB 3.1.1 error contexts are iterated with a loop condition of "p < end", but the parser reads fields from the current context header without first ensuring the full header fits in bounds. A server-controlled ErrorDataLength can advance the parser pointer to within 1-7 bytes of the end of the buffer, causing the next iteration to read past the end. Additionally, when a matching context is found, the code reads SymLinkErrorTag from ErrorContextData without verifying that the symlink header itself is fully present. A second bounds error exists in smb2_parse_symlink_response(), which validates the substitute name using a fixed SMB2_SYMLINK_STRUCT_SIZE offset from iov_base. That offset is only correct when ErrorContextCount is zero; when one or more error contexts are present, the actual symlink data is deeper in the buffer and may be shifted further by skipped contexts. As a result, substitute-name parsing can run past iov_len and consume out-of-bounds heap data.