{"id":"CVE-2026-99113","kind":"vulnerability","aliases":["CVE-2026-99113"],"related":[],"title":"Linux ksmbd: stale kernel memory leaks in compound SMB filesystem info replies","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in\n\nsmb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION,\nthat is the whole of struct object_id_info, but writes only 46 of them:\n\n - objid[] is 16 bytes, and when the volume UUID is not available only\n   sizeof(stfs.f_fsid) (8) bytes are copied into it;\n - extended_info.version_string[] is STRING_LENGTH (28) bytes, and only\n   strlen(\"1.1.0\") (5) bytes are copied into it.\n\nThe response buffer is zeroed on allocation (kvzalloc() in\nsmb2_allocate_rsp_buf()), so for a standalone request the remaining 31\nbytes are zero.  In a compound request they need not be.  The offset of\nthe next response is advanced by the length pinned for the previous one,\nso if a preceding command wrote its reply into the buffer and then\nfailed, smb2_set_err_rsp() pins only the short error response and the\nnext reply lands inside the area that has already been written.  Only\nthe header is cleared there:\n\n\tmemset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);\n\nThe client then receives up to 31 bytes of a response it was not meant\nto see, including one that failed with an access denied error.\n\nClear the structure before filling it in.  As a side effect\nversion_string is now NUL terminated.","summary":"ksmbd, the in-kernel SMB server, fills the FS_OBJECT_ID_INFORMATION reply without zeroing its 64-byte buffer, so in a compound request leftover bytes from an earlier reply can be sent to the client. An authenticated SMB client can read up to 31 bytes of kernel memory per affected reply, including data from a reply that failed with access denied.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-server","kernel","ksmbd","linux","runtime","self-hosted"],"not_affected_if":["ksmbd-not-loaded","no-smb-shares","samba-instead"],"how_to_check":"- Check whether ksmbd is loaded on the host with `lsmod | grep ksmbd` or `modinfo ksmbd`\n- Check the running kernel with `uname -r` and compare it to the fixed stable release listed by the kernel advisory\n- unknown whether a specific kernel version range is affected; the sources do not list one","fix":"- Update the Linux kernel to a stable release that includes the upstream commit zeroing the FS_OBJECT_ID_INFORMATION buffer, `unknown` version\n- If ksmbd is not needed, unload it with `rmmod ksmbd` or disable the ksmbd service\n- unknown whether a distribution backport or mitigation exists; the sources do not say","status":"open","published_at":"2026-10-28T11:17:30+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:42+00:00","updated_at":"2026-10-28T11:37:42+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:37:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the upstream commit zeroing the FS_OBJECT_ID_INFORMATION buffer, `unknown` version\n- If ksmbd is not needed, unload it with `rmmod ksmbd` or disable the ksmbd service\n- unknown whether a distribution backport or mitigation exists; the sources do not say","reach":"network","title":"Linux ksmbd: stale kernel memory leaks in compound SMB filesystem info replies","impact":"low","summary":"ksmbd, the in-kernel SMB server, fills the FS_OBJECT_ID_INFORMATION reply without zeroing its 64-byte buffer, so in a compound request leftover bytes from an earlier reply can be sent to the client. An authenticated SMB client can read up to 31 bytes of kernel memory per affected reply, including data from a reply that failed with access denied.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","ksmbd","self-hosted","file-server"],"confidence":0.6,"needs_auth":"yes","worst_case":"Remote SMB client reads leftover kernel memory from file server responses","analyst_note":"Confirm affected and fixed kernel version ranges and the upstream commit from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-99113.","how_to_check":"- Check whether ksmbd is loaded on the host with `lsmod | grep ksmbd` or `modinfo ksmbd`\n- Check the running kernel with `uname -r` and compare it to the fixed stable release listed by the kernel advisory\n- unknown whether a specific kernel version range is affected; the sources do not list one","needs_analyst":true,"not_affected_if":["samba-instead","ksmbd-not-loaded","no-smb-shares"],"who_is_affected":"Only systems running the in-kernel ksmbd SMB server are exposed, typically Linux file servers that share folders over SMB. Hosts using Samba (smbd), a Windows server, or any other SMB stack are not affected by this kernel code path. Machines that do not run ksmbd can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000764,"input_tokens":3742,"output_tokens":780,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99113':15A,18A '0':274C '1.1.0':172C '16':143C '2':279C '28':167C '31':74B,199C,286C '46':138C '5':173C '64':46B,119C '8':156C 'access':90B,303C 'advanc':218C 'affect':80B 'alloc':185C,189C 'alreadi':261C 'area':258C 'authent':67B 'avail':152C 'buf':191C 'buffer':48B,109C,181C,237C 'byte':47B,55B,75B,120C,144C,157C,168C,174C,200C,287C 'char':271C 'clear':268C,306C 'client':65B,69B,281C 'command':231C 'compound':8A,52B,205C 'copi':159C,176C 'cve':13A,16A 'data':83B 'deni':91B,304C 'earlier':58B 'effect':316C 'err':243C 'error':249C,305C 'extended_info.version':162C 'fail':88B,240C,300C 'file':20B 'file-serv':19B 'filesystem':10A,117C 'fill':36B,111C,310C 'follow':97C 'fs':38B,105C,122C 'get':115C 'hdr':273C,278C 'header':266C 'host':28B 'id':40B,107C,124C,133C 'in-kernel':31B 'includ':82B,297C 'info':11A,116C,134C 'inform':41B,108C,125C 'insid':256C 'kernel':4A,22B,33B,77B,95C 'ksmbd':2A,23B,29B,102C 'kvzalloc':186C 'land':255C 'leak':6A 'leftov':54B 'length':166C,221C 'linux':1A,24B,94C 'meant':294C 'memori':5A,78B 'memset':270C 'need':208C 'next':215C,253C 'nul':321C 'object':39B,106C,123C,132C 'objid':141C 'offset':212C 'one':226C,298C 'per':79B 'pin':222C,245C 'preced':230C 'previous':225C 'read':71B 'receiv':283C 'remain':198C 'repli':12A,42B,59B,81B,86B,234C,254C 'report':118C 'request':53B,196C,206C 'resolv':101C 'respons':180C,216C,250C,290C 'rsp':190C,244C,272C 'runtim':25B 'see':296C 'self':27B 'self-host':26B 'sent':62B 'server':21B,35B 'set':242C 'short':248C 'side':315C 'sizeof':154C,275C 'smb':9A,34B,68B 'smb2':114C,188C,241C,277C 'stale':3A 'standalon':195C 'stfs.f_fsid':155C 'string':163C,165C,318C 'strlen':171C 'struct':131C,276C 'structur':308C 'termin':322C 'uuid':149C 'version':317C 'volum':148C 'vulner':98C 'whole':129C 'without':43B 'write':136C 'written':263C 'wrote':232C 'zero':44B,103C,183C,202C","nicknames":[],"mitigations":[],"who_affected":"Only systems running the in-kernel ksmbd SMB server are exposed, typically Linux file servers that share folders over SMB. Hosts using Samba (smbd), a Windows server, or any other SMB stack are not affected by this kernel code path. Machines that do not run ksmbd can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99113","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99113","severity":null,"published_at":"2026-10-28T11:17:30+00:00","modified_at":"2026-10-28T11:17:30+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}