{"id":"CVE-2026-99083","kind":"vulnerability","aliases":["CVE-2026-99083"],"related":[],"title":"Linux kernel ksmbd: compounded SMB request overflows heap during Kerberos login","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space.","summary":"In the Linux kernel's ksmbd SMB server, a Kerberos session setup sent as part of a compounded SMB2 request miscalculates the free space in the response buffer. That lets memcpy() write the authentication reply past the end of the buffer into adjacent kernel heap memory.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kerberos","ksmbd","linux-kernel","runtime","self-hosted","smb-server"],"not_affected_if":["ksmbd-not-enabled","samba-userspace"],"how_to_check":"- Check whether the kernel has ksmbd built in or loaded with `lsmod | grep ksmbd`\n- Check whether the in-kernel SMB server is running with `systemctl status ksmbd` or by looking for the ksmbd process\n- Compare the running kernel with the fixed release in the kernel git log for the ksmbd fix (unknown from the sources)","fix":"- Update the Linux kernel to a release that includes the upstream ksmbd fix (the exact version is unknown from the sources)\n- If the ksmbd server is not needed, unload it with `modprobe -r ksmbd` or disable the service","status":"open","published_at":"2026-10-23T13:17:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:53:36+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:53:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream ksmbd fix (the exact version is unknown from the sources)\n- If the ksmbd server is not needed, unload it with `modprobe -r ksmbd` or disable the service","reach":"network","title":"Linux kernel ksmbd: compounded SMB request overflows heap during Kerberos login","impact":"high","summary":"In the Linux kernel's ksmbd SMB server, a Kerberos session setup sent as part of a compounded SMB2 request miscalculates the free space in the response buffer. That lets memcpy() write the authentication reply past the end of the buffer into adjacent kernel heap memory.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ksmbd","smb-server","kerberos","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote heap memory corruption in the kernel could lead to code execution","analyst_note":"Confirm the fixed kernel versions and the exact authentication requirement from the NVD entry or the upstream kernel commit.","how_to_check":"- Check whether the kernel has ksmbd built in or loaded with `lsmod | grep ksmbd`\n- Check whether the in-kernel SMB server is running with `systemctl status ksmbd` or by looking for the ksmbd process\n- Compare the running kernel with the fixed release in the kernel git log for the ksmbd fix (unknown from the sources)","needs_analyst":true,"not_affected_if":["ksmbd-not-enabled","samba-userspace"],"who_is_affected":"Systems that run the Linux kernel's built-in ksmbd SMB file server and accept Kerberos authentication over SMB2 are exposed. Hosts that do not run ksmbd, or that use Samba in userspace instead, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000698,"input_tokens":3567,"output_tokens":682,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99083':14A,17A 'accur':218C 'adjac':72B,198C 'allow':182C 'ap':116C,188C 'ap-rep':115C,187C 'authent':63B,96C,99C,173C 'avail':106C 'blob':178C,190C 'bound':92C 'buf':110C,196C 'buffer':57B,70B,153C,222C 'calcul':103C,138C 'caus':147C 'chain':165C 'check':169C 'compound':4A,47B,134C,164C 'comput':213C 'consequ':166C 'cumul':157C 'cve':12A,15A 'determin':105C 'element':131C 'end':67B,193C 'ensur':216C 'erron':181C 'first':130C 'fix':87C,202C 'follow':81C 'free':52B 'hdr':144C,210C 'headroom':107C,154C 'heap':8A,74B,88C,200C 'host':26B 'howev':119C 'incom':113C 'kerbero':10A,18B,39B,114C 'kernel':2A,22B,33B,73B,79C,199C 'krb5':95C,98C,172C 'ksmbd':3A,19B,35B,86C,171C 'len':101C,149C,175C,179C,215C 'length':168C 'let':59B 'linux':1A,21B,32B,78C 'linux-kernel':20B 'login':11A 'memcpi':60B,183C 'memori':75B,201C 'miscalcul':50B 'next':141C,207C 'non':129C 'non-first':128C 'omit':139C 'out-of-bound':89C 'overflow':7A 'overst':151C 'part':44B 'pass':180C 'past':65B,191C 'physic':220C 'prior':160C 'process':125C 'reflect':219C 'remain':152C,221C 'rep':117C,189C 'repli':64B 'request':6A,49B,136C 'resolv':85C 'resp':176C 'respons':56B,109C,161C,195C 'rsp':143C,209C 'runtim':23B 'self':25B 'self-host':24B 'sent':42B 'server':29B,37B 'session':40B,122C 'setup':41B,123C 'size':158C 'smb':5A,28B,36B 'smb-server':27B 'smb2':48B,121C,135C,142C,208C 'space':53B,223C 'spnego':177C 'subtract':205C 'token':118C 'vulner':82C 'work':140C,206C 'write':61B,93C,185C","nicknames":[],"mitigations":[],"who_affected":"Systems that run the Linux kernel's built-in ksmbd SMB file server and accept Kerberos authentication over SMB2 are exposed. Hosts that do not run ksmbd, or that use Samba in userspace instead, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99083","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99083","severity":null,"published_at":"2026-10-23T13:17:32+00:00","modified_at":"2026-10-23T13:17:32+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99083","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99083","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}