{"id":"CVE-2026-99115","kind":"vulnerability","aliases":["CVE-2026-99115"],"related":[],"title":"Linux kernel ksmbd: SMB compound request can leak stale kernel memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION\n\nsmb2_get_info_filesystem() reports 56 bytes for FS_POSIX_INFORMATION,\nthat is the whole of FILE_SYSTEM_POSIX_INFO, but never assigns\nFileSysIdentifier.  Those eight bytes go to the client as they are found\nin the response buffer.\n\nThe buffer is zeroed on allocation, so a standalone request leaks\nnothing.  A compound request can leak: the offset of the next response\nis advanced by the length pinned for the previous one, so a reply that\nwas written into the buffer and then dropped in favour of the short\nerror response of smb2_set_err_rsp() stays there, and the next reply is\nlaid over it with only the header cleared.\n\nReport the file system id statfs() returned, which is what the field is\nfor.  FileSysIdentifier is __le64 and f_fsid is a pair of ints, so\nassemble the value first, val[0] as the low half, and convert it on the\nway out.","summary":"ksmbd, the in-kernel SMB server, returns eight bytes of the FileSysIdentifier field in FS_POSIX_INFORMATION that were never set. In a compound SMB request, those bytes can hold leftover data from a previously dropped response, so a client may read kernel memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["file-servers","ksmbd","linux-kernel","runtime","self-hosted"],"not_affected_if":["ksmbd-not-loaded","samba-only"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream commit filling in FileSysIdentifier in ksmbd (fixed version not stated in the source)\n- Unload or disable the ksmbd module if SMB serving from the kernel is not needed (`lsmod | grep ksmbd`)","status":"open","published_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:39+00:00","updated_at":"2026-10-28T11:37:39+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:37:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit filling in FileSysIdentifier in ksmbd (fixed version not stated in the source)\n- Unload or disable the ksmbd module if SMB serving from the kernel is not needed (`lsmod | grep ksmbd`)","reach":"network","title":"Linux kernel ksmbd: SMB compound request can leak stale kernel memory","impact":"low","summary":"ksmbd, the in-kernel SMB server, returns eight bytes of the FileSysIdentifier field in FS_POSIX_INFORMATION that were never set. In a compound SMB request, those bytes can hold leftover data from a previously dropped response, so a client may read kernel memory.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ksmbd","self-hosted","file-servers"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote client reads leftover kernel memory bytes from SMB responses","analyst_note":"Find the fixed kernel version and the upstream commit for the ksmbd FileSysIdentifier fix; check whether the source says ksmbd authentication is required for compound requests.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["ksmbd-not-loaded","samba-only"],"who_is_affected":"Systems running the Linux kernel with the ksmbd SMB server module enabled and reachable by clients. Hosts that do not run ksmbd, or that serve SMB through Samba instead, are not affected by this ksmbd code path. The sources do not state the affected kernel version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000658,"input_tokens":3580,"output_tokens":600,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99115':14A,17A '0':234C '56':97C 'advanc':155C 'alloc':136C 'assembl':229C 'assign':114C 'buffer':130C,132C,172C 'byte':38B,57B,98C,118C 'clear':202C 'client':69B,122C 'compound':5A,53B,144C 'convert':240C 'cve':12A,15A 'data':61B 'drop':65B,175C 'eight':37B,117C 'err':186C 'error':181C 'f':221C 'favour':177C 'field':42B,214C 'file':19B,108C,205C 'file-serv':18B 'filesysidentifi':41B,87C,115C,217C 'filesystem':95C 'fill':85C 'first':232C 'follow':79C 'found':126C 'fs':44B,89C,100C 'fsid':222C 'get':93C 'go':119C 'half':238C 'header':201C 'hold':59B 'host':28B 'id':207C 'in-kernel':31B 'info':94C,111C 'inform':46B,91C,102C 'int':227C 'kernel':2A,10A,24B,33B,72B,77C 'ksmbd':3A,21B,29B,84C 'laid':195C 'le64':219C 'leak':8A,141C,147C 'leftov':60B 'length':158C 'linux':1A,23B,76C 'linux-kernel':22B 'low':237C 'may':70B 'memori':11A,73B 'never':49B,113C 'next':152C,192C 'noth':142C 'offset':149C 'one':163C 'pair':225C 'pin':159C 'posix':45B,90C,101C,110C 'previous':64B,162C 'read':71B 'repli':166C,193C 'report':96C,203C 'request':6A,55B,140C,145C 'resolv':83C 'respons':66B,129C,153C,182C 'return':36B,209C 'rsp':187C 'runtim':25B 'self':27B 'self-host':26B 'server':20B,35B 'set':50B,185C 'short':180C 'smb':4A,34B,54B 'smb2':92C,184C 'stale':9A 'standalon':139C 'statf':208C 'stay':188C 'system':109C,206C 'val':233C 'valu':231C 'vulner':80C 'way':244C 'whole':106C 'written':169C 'zero':134C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with the ksmbd SMB server module enabled and reachable by clients. Hosts that do not run ksmbd, or that serve SMB through Samba instead, are not affected by this ksmbd code path. The sources do not state the affected kernel version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99115","severity":null,"published_at":"2026-10-28T11:17:31+00:00","modified_at":"2026-10-28T11:17:31+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}