SMB Client Vulnerability in Linux Kernel Affecting File Management Operations

CVE-2026-99274

What is CVE-2026-99274?

A vulnerability exists in the SMB client of the Linux kernel where improper handling of a malformed response can lead to buffer overflow. Specifically, this issue arises when the smb3_fiemap() function processes an empty truncated response from an SMB2 server. It fails to properly evaluate length checks, which allows for the potential reading of memory that should not be accessed, creating risks of application crashes or further exploitation. This flaw was observed when a malicious SMB2 server responds with a STATUS_BUFFER_OVERFLOW and an OutputCount of zero, resulting in unexpected behavior. This vulnerability has been addressed to ensure that any truncated range blobs that contain no range are rejected, preventing potential infinite loops and memory access violations.

References