CVE-2026-99273 · Package
NO FIX YET
The ksmbd SMB file server in the Linux kernel writes a UTF-16 terminator two bytes past the end of a small response buffer when stream info exactly fills it. The sources do not state what an attacker can do with that out-of-bounds write.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
ksmbd is the in-kernel SMB server, so the exposure is for Linux systems that run it as an SMB file share. The sources do not state which kernel versions are affected or whether the server must be enabled. Hosts that do not run ksmbd are not affected.
Not affected if ksmbd-disabled
Who cares ksmbd, linux-kernel, smb-server
Unknown from the sources.
Unknown from the sources.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reserve space for the UTF-16 terminator in stream info
smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but get_file_stream_info() budgets only sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing "::$DATA" entry. When an entry exactly fills the 448-byte small response buffer, the terminator is written two bytes past the allocation.
Reserve one extra UTF-16 unit in both budget checks. The terminator is not part of the wire format, so the reported lengths are unchanged.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.