Heap Out-of-Bounds Write Vulnerability in Linux Kernel Affecting SMB2 Session Setup

CVE-2026-99083

What is CVE-2026-99083?

A vulnerability in the Linux kernel's ksmbd component allows for a heap out-of-bounds write due to improper calculation of available buffer space during the Kerberos AP-REP token processing. When handling an SMB2_SESSION_SETUP request as part of a compound request, the calculation for out_len mistakenly fails to account for the offset of subsequent responses. This oversight can lead to unauthorized memory writes past the end of designated buffers, potentially enabling attackers to exploit adjacent kernel memory. A fix has been implemented to ensure accurate buffer size calculations, mitigating the risk associated with this vulnerability.

References