Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-99083

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to < 59c6dcc5dd9dafe764ca0d40525933b2be69b059affected
  • 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to < 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27aaffected
  • 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to < 517404e157395d0f8da125ca956c566895dfcd06affected
  • 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to < 4722d06b2907585074252061b1024a696c1cfc23affected
  • 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to < 23a0be6a84a38ac169eeab49017934e8e27c65f0affected
  • 676392184785ace61e939831e7ca44a03d438c3baffected
  • ef572ffa8eb44111eed2925fbb2adca78bdcbf61affected
  • 2ba03cecb12ac7ac9e0170e251543c56832d9959affected
  • 5.15.145 to < 5.16affected
  • 6.1.40 to < 6.2affected
  • 6.4.5 to < 6.5affected

Linux Linux

Default version status: affected

  • 6.5affected
  • 0 to < 6.5unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.114 to ≤ 6.12.*unaffected
  • 6.18.58 to ≤ 6.18.*unaffected
  • 7.2.12 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References