{"id":"CVE-2026-99273","kind":"vulnerability","aliases":["CVE-2026-99273"],"related":[],"title":"Linux kernel ksmbd: stream info writes past its response buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reserve space for the UTF-16 terminator in stream info\n\nsmb_strtoUTF16() always writes a terminating zero UTF-16 unit after the\nconverted characters, but get_file_stream_info() budgets only\nsizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry\nand sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing\n\"::$DATA\" entry. When an entry exactly fills the 448-byte small response\nbuffer, the terminator is written two bytes past the allocation.\n\nReserve one extra UTF-16 unit in both budget checks. The terminator is\nnot part of the wire format, so the reported lengths are unchanged.","summary":"The ksmbd SMB file server in the Linux kernel writes a UTF-16 terminator two bytes past the end of a small response buffer when stream info exactly fills it. The sources do not state what an attacker can do with that out-of-bounds write.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ksmbd","linux-kernel","package","smb-server"],"not_affected_if":["ksmbd-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","triaged_at":"2026-11-07T14:49:56+00:00","updated_at":"2026-11-07T14:49:56+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-07T14:49:56Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Linux kernel ksmbd: stream info writes past its response buffer","impact":"medium","summary":"The ksmbd SMB file server in the Linux kernel writes a UTF-16 terminator two bytes past the end of a small response buffer when stream info exactly fills it. The sources do not state what an attacker can do with that out-of-bounds write.","audience":"businesses","category":"package","nicknames":[],"who_cares":["linux-kernel","ksmbd","smb-server"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown memory write in kernel, impact not stated","analyst_note":"Check the NVD entry and the kernel stable commit for affected and fixed kernel versions and the exploitability of the two-byte overflow.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["ksmbd-disabled"],"who_is_affected":"ksmbd is the in-kernel SMB server, so the exposure is for Linux systems that run it as an SMB file share. The sources do not state which kernel versions are affected or whether the server must be enabled. Hosts that do not run ksmbd are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4389,"output_tokens":468,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-16':37B,88C,101C,164C '-2026':12A,15A '-99273':13A,16A '2':121C,134C '448':146C '7':133C 'alloc':159C 'alway':95C 'attack':62B 'bound':70B 'budget':112C,168C 'buffer':10A,48B,150C 'byte':40B,147C,156C 'charact':106C 'check':169C 'convert':105C 'cve':11A,14A 'data':138C 'end':43B 'entri':125C,139C,142C 'exact':52B,143C 'extra':162C 'file':28B,109C,117C,130C 'fill':53B,144C 'follow':77C 'format':178C 'get':108C 'info':5A,51B,92C,111C,119C,132C 'kernel':2A,20B,33B,75C 'ksmbd':3A,17B,26B,82C 'length':182C 'linux':1A,19B,32B,74C 'linux-kernel':18B 'one':161C 'out-of-bound':67B 'packag':21B 'part':174C 'past':7A,41B,157C 'report':181C 'reserv':83C,160C 'resolv':81C 'respons':9A,47B,149C 'server':24B,29B 'sizeof':114C,127C 'small':46B,148C 'smb':23B,27B,93C 'smb-server':22B 'smb2':116C,129C 'sourc':56B 'space':84C 'state':59B 'stream':4A,50B,91C,110C,118C,124C,131C 'streamlen':120C 'strtoutf16':94C 'struct':115C,128C 'termin':38B,89C,98C,152C,171C 'trail':137C 'two':39B,155C 'unchang':184C 'unit':102C,165C 'utf':36B,87C,100C,163C 'vulner':78C 'wire':177C 'write':6A,34B,71B,96C 'written':154C 'zero':99C","nicknames":[],"mitigations":[],"who_affected":"ksmbd is the in-kernel SMB server, so the exposure is for Linux systems that run it as an SMB file share. The sources do not state which kernel versions are affected or whether the server must be enabled. Hosts that do not run ksmbd are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ksmbd","linuxkernel","package","smbserver","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-99273':13A,16A 'buffer':10A 'cve':11A,14A 'info':5A 'kernel':2A 'ksmbd':3A 'linux':1A 'past':7A 'respons':9A 'stream':4A 'write':6A","search_b":"'-16':37B 'attack':62B 'bound':70B 'buffer':48B 'byte':40B 'end':43B 'exact':52B 'file':28B 'fill':53B 'info':51B 'kernel':20B,33B 'ksmbd':17B,26B 'linux':19B,32B 'linux-kernel':18B 'out-of-bound':67B 'packag':21B 'past':41B 'respons':47B 'server':24B,29B 'small':46B 'smb':23B,27B 'smb-server':22B 'sourc':56B 'state':59B 'stream':50B 'termin':38B 'two':39B 'utf':36B 'write':34B,71B","search_c":"'-16':88C,101C,164C '2':121C,134C '448':146C '7':133C 'alloc':159C 'alway':95C 'budget':112C,168C 'buffer':150C 'byte':147C,156C 'charact':106C 'check':169C 'convert':105C 'data':138C 'entri':125C,139C,142C 'exact':143C 'extra':162C 'file':109C,117C,130C 'fill':144C 'follow':77C 'format':178C 'get':108C 'info':92C,111C,119C,132C 'kernel':75C 'ksmbd':82C 'length':182C 'linux':74C 'one':161C 'part':174C 'past':157C 'report':181C 'reserv':83C,160C 'resolv':81C 'respons':149C 'sizeof':114C,127C 'small':148C 'smb':93C 'smb2':116C,129C 'space':84C 'stream':91C,110C,118C,124C,131C 'streamlen':120C 'strtoutf16':94C 'struct':115C,128C 'termin':89C,98C,152C,171C 'trail':137C 'two':155C 'unchang':184C 'unit':102C,165C 'utf':87C,100C,163C 'vulner':78C 'wire':177C 'write':96C 'written':154C 'zero':99C","first_public_at":"2026-11-07T14:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99273","severity":null,"published_at":"2026-11-07T14:17:02+00:00","modified_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","fetched_at":"2026-11-07T14:47:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}