SMB Client Vulnerability in Linux Kernel Affecting Multiple Distributions

CVE-2026-99272

What is CVE-2026-99272?

A vulnerability exists in the SMB client implementation of the Linux kernel, whereby the SMB2_read() function fails to validate the range of the data area being copied. This oversight allows a malicious server to provide a crafted response that leads to potentially unsafe memory access. Specifically, if a READ response is configured with a DataOffset of zero and a DataLength that exceeds the actual size of the received data, it could result in an out-of-bounds copy operation. By exploiting this flaw, an attacker could manipulate the client into accessing unintended memory regions, which may compromise system integrity or lead to unintended information disclosure. To mitigate this risk, the kernel has introduced measures to check that the DataOffset and DataLength fit within the received data limits.

References