Cloudanix VulnDB

CVE-2026-99083

High · 8.8

CVSS

8.8

EPSS

0.4%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's built-in file-sharing code can let a remote user corrupt memory and potentially take over the whole computer if they send a specially crafted login request.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Remote Code Execution
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Heap out-of-bounds write in ksmbd krb5_authenticate() caused by incorrect out_len calculation that ignores work->next_smb2_rsp_hdr_off on compounded SMB2_SESSION_SETUP requests, allowing memcpy of AP-REP token to overwrite adjacent kernel heap memory.

Why it matters to the business

Kernel memory corruption on Linux SMB servers can lead to crashes, data corruption, or full system compromise; although not yet observed in the wild, the flaw affects any kernel with ksmbd enabled and requires prompt patching because public details already exist.

How an attack unfolds

An attacker establishes an SMB connection, crafts a compounded SMB2 request that places SESSION_SETUP (with Kerberos authentication) after at least one prior command, supplies a malicious AP-REP token sized to exceed the miscalculated buffer headroom, and triggers the erroneous memcpy that writes past the end of response_buf into kernel heap.

How to fix it

Apply the upstream kernel patch that subtracts work->next_smb2_rsp_hdr_off when computing out_len in krb5_authenticate(); rebuild and deploy the fixed kernel on all systems running ksmbd; if immediate patching is impossible, disable ksmbd or restrict SMB access to trusted networks.

How to confirm the fix worked

Confirm the patch is present by inspecting the krb5_authenticate() source for the subtraction of next_smb2_rsp_hdr_off; test with a compounded SMB2 request containing Kerberos auth and verify that the length check now correctly accounts for prior response headers without triggering an out-of-bounds write.

Typical attack path

  1. Connect to ksmbd over TCP/445
  2. Send a compounded SMB2 request whose first element is not SESSION_SETUP
  3. Include a Kerberos AP-REP token in the SESSION_SETUP that exceeds the erroneously computed remaining buffer length
  4. Trigger memcpy that performs the out-of-bounds write into adjacent kernel heap structures

How to detect it

Search SMB server logs and kernel audit trails for compounded SMB2 requests that contain SESSION_SETUP as a non-first element followed by Kerberos authentication blobs; look for subsequent kernel oops or slab corruption warnings referencing ksmbd response buffers.

What your security team should do

  • Prioritize kernel updates on all hosts exposing ksmbd within the next 7 days given the public exploit details
  • Audit configurations to ensure ksmbd is only enabled on systems that truly require it
  • Implement network segmentation or firewall rules limiting SMB traffic to authorized clients until patches are applied
  • Monitor kernel logs for oops/panic messages referencing ksmbd or krb5_authenticate after any SMB session-setup activity

The record

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.

Affected packages

Ecosystem Package Introduced Fixed