Live › vulnerability › CVE-2026-99083
Go to dashboardIn the Linux kernel's ksmbd SMB server, a Kerberos session setup sent as part of a compounded SMB2 request miscalculates the free space in the response buffer. That lets memcpy() write the authentication reply past the end of the buffer into adjacent kernel heap memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that run the Linux kernel's built-in ksmbd SMB file server and accept Kerberos authentication over SMB2 are exposed. Hosts that do not run ksmbd, or that use Samba in userspace instead, are not affected by this flaw.
No product ranges from the sources yet.
lsmod | grep ksmbdsystemctl status ksmbd or by looking for the ksmbd processmodprobe -r ksmbd or disable the serviceEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
This page as .md · .json · in your agent: get_signal("CVE-2026-99083")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.