{"id":"CVE-2026-99272","kind":"vulnerability","aliases":["CVE-2026-99272"],"related":[],"title":"Linux kernel SMB client: malicious server can overread memory during reads","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate the data area in SMB2_read()\n\nSMB2_read() copies le32_to_cpu(rsp->DataLength) bytes from\n(char *)rsp + rsp->DataOffset without checking that the range lies\nwithin the response actually received. A READ response with\nDataOffset == 0 makes smb2_get_data_area_len() zero the data length, so\nsmb2_check_message() accepts a frame as short as the fixed response,\nwhile SMB2_read() still uses the server-supplied DataLength, capped only\nby CIFS_MAX_MSGSIZE and the caller's length.\n\nA malicious server can answer the synchronous read used by the\nmfsymlinks (or SFU) symlink parser with an 81-byte READ response\ncarrying DataOffset 0 and DataLength 1067, making the client copy 1067\nbytes from a 448-byte receive object (KASAN slab-out-of-bounds; up to\n16 KiB in the general case).\n\nClamp a zero (or header-overlapping) DataOffset to read_rsp_size, as\nhandle_read_data() does for the asynchronous path, and reject the\nresponse unless DataOffset + DataLength fits within rsp_iov.iov_len.\nThe SMB1 helper was fixed the same way in 5be5bdda5863.","summary":"The Linux kernel's SMB2 client copies more data than the server's read response actually contains when a READ response has a zero data offset. A malicious SMB server can make the client copy memory beyond the received buffer, which the sources describe as a KASAN slab-out-of-bounds read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","linux-clients","linux-kernel","runtime","smb"],"not_affected_if":["no-smb-mounts","trusted-servers-only"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","triaged_at":"2026-11-07T14:49:56+00:00","updated_at":"2026-11-07T14:49:56+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-07T14:49:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel SMB client: malicious server can overread memory during reads","impact":"medium","summary":"The Linux kernel's SMB2 client copies more data than the server's read response actually contains when a READ response has a zero data offset. A malicious SMB server can make the client copy memory beyond the received buffer, which the sources describe as a KASAN slab-out-of-bounds read.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","smb","cifs","linux-clients"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Malicious server causes out-of-bounds memory read in client kernel","analyst_note":"Check the upstream kernel commit and stable-branch fixed versions for this CVE; the sources give no product ranges.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-smb-mounts","trusted-servers-only"],"who_is_affected":"Affected systems are Linux machines running the kernel SMB client (CIFS/SMB2 mounts, including mfsymlinks or SFU symlink handling) that connect to SMB servers. The attacker must control or impersonate the SMB server the client connects to. Machines that do not mount SMB shares are not exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000712,"input_tokens":4561,"output_tokens":511,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99272':14A,17A '0':129C,198C '1067':201C,206C '16':222C '448':210C '5be5bdda5863':269C '81':192C 'accept':144C 'actual':42B,122C 'answer':178C 'area':95C,134C 'asynchron':247C 'beyond':63B 'bound':78B,219C 'buffer':66B 'byte':107C,193C,207C,211C 'caller':171C 'cap':163C 'carri':196C 'case':227C 'char':109C 'check':114C,142C 'cif':18B,166C 'clamp':228C 'client':4A,21B,32B,60B,91C,204C 'contain':43B 'copi':33B,61B,101C,205C 'cpu':104C 'cve':12A,15A 'data':35B,51B,94C,133C,138C,243C 'datalength':106C,162C,200C,255C 'dataoffset':112C,128C,197C,235C,254C 'describ':70B 'fit':256C 'fix':151C,264C 'follow':85C 'frame':146C 'general':226C 'get':132C 'handl':241C 'header':233C 'header-overlap':232C 'helper':262C 'kasan':73B,214C 'kernel':2A,24B,29B,83C 'kib':223C 'le32':102C 'len':135C,259C 'length':139C,173C 'lie':118C 'linux':1A,20B,23B,28B,82C 'linux-cli':19B 'linux-kernel':22B 'make':58B,130C,202C 'malici':5A,54B,175C 'max':167C 'memori':9A,62B 'messag':143C 'mfsymlink':185C 'msgsize':168C 'object':213C 'offset':52B 'overlap':234C 'overread':8A 'parser':189C 'path':248C 'rang':117C 'read':11A,40B,46B,79B,98C,100C,125C,155C,181C,194C,237C,242C 'receiv':65B,123C,212C 'reject':250C 'resolv':89C 'respons':41B,47B,121C,126C,152C,195C,252C 'rsp':105C,110C,111C,238C 'rsp_iov.iov':258C 'runtim':25B 'server':6A,38B,56B,160C,176C 'server-suppli':159C 'sfu':187C 'short':148C 'size':239C 'slab':75B,216C 'slab-out-of-bound':74B,215C 'smb':3A,26B,55B,90C 'smb1':261C 'smb2':31B,97C,99C,131C,141C,154C 'sourc':69B 'still':156C 'suppli':161C 'symlink':188C 'synchron':180C 'unless':253C 'use':157C,182C 'valid':92C 'vulner':86C 'way':267C 'within':119C,257C 'without':113C 'zero':50B,136C,230C","nicknames":[],"mitigations":[],"who_affected":"Affected systems are Linux machines running the kernel SMB client (CIFS/SMB2 mounts, including mfsymlinks or SFU symlink handling) that connect to SMB servers. The attacker must control or impersonate the SMB server the client connects to. Machines that do not mount SMB shares are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cifs","linuxclients","linuxkernel","runtime","smb","unknown"],"campaign_type":null,"search_a":"'-2026':13A,16A '-99272':14A,17A 'client':4A 'cve':12A,15A 'kernel':2A 'linux':1A 'malici':5A 'memori':9A 'overread':8A 'read':11A 'server':6A 'smb':3A","search_b":"'actual':42B 'beyond':63B 'bound':78B 'buffer':66B 'cif':18B 'client':21B,32B,60B 'contain':43B 'copi':33B,61B 'data':35B,51B 'describ':70B 'kasan':73B 'kernel':24B,29B 'linux':20B,23B,28B 'linux-cli':19B 'linux-kernel':22B 'make':58B 'malici':54B 'memori':62B 'offset':52B 'read':40B,46B,79B 'receiv':65B 'respons':41B,47B 'runtim':25B 'server':38B,56B 'slab':75B 'slab-out-of-bound':74B 'smb':26B,55B 'smb2':31B 'sourc':69B 'zero':50B","search_c":"'0':129C,198C '1067':201C,206C '16':222C '448':210C '5be5bdda5863':269C '81':192C 'accept':144C 'actual':122C 'answer':178C 'area':95C,134C 'asynchron':247C 'bound':219C 'byte':107C,193C,207C,211C 'caller':171C 'cap':163C 'carri':196C 'case':227C 'char':109C 'check':114C,142C 'cif':166C 'clamp':228C 'client':91C,204C 'copi':101C,205C 'cpu':104C 'data':94C,133C,138C,243C 'datalength':106C,162C,200C,255C 'dataoffset':112C,128C,197C,235C,254C 'fit':256C 'fix':151C,264C 'follow':85C 'frame':146C 'general':226C 'get':132C 'handl':241C 'header':233C 'header-overlap':232C 'helper':262C 'kasan':214C 'kernel':83C 'kib':223C 'le32':102C 'len':135C,259C 'length':139C,173C 'lie':118C 'linux':82C 'make':130C,202C 'malici':175C 'max':167C 'messag':143C 'mfsymlink':185C 'msgsize':168C 'object':213C 'overlap':234C 'parser':189C 'path':248C 'rang':117C 'read':98C,100C,125C,155C,181C,194C,237C,242C 'receiv':123C,212C 'reject':250C 'resolv':89C 'respons':121C,126C,152C,195C,252C 'rsp':105C,110C,111C,238C 'rsp_iov.iov':258C 'server':160C,176C 'server-suppli':159C 'sfu':187C 'short':148C 'size':239C 'slab':216C 'slab-out-of-bound':215C 'smb':90C 'smb1':261C 'smb2':97C,99C,131C,141C,154C 'still':156C 'suppli':161C 'symlink':188C 'synchron':180C 'unless':253C 'use':157C,182C 'valid':92C 'vulner':86C 'way':267C 'within':119C,257C 'without':113C 'zero':136C,230C","first_public_at":"2026-11-07T14:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99272","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99272","severity":null,"published_at":"2026-11-07T14:17:02+00:00","modified_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","fetched_at":"2026-11-07T14:47:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}