{"id":"CVE-2026-99274","kind":"vulnerability","aliases":["CVE-2026-99274"],"related":[],"title":"Linux kernel: malicious SMB server crashes client via fiemap read","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix fiemap wild read on empty truncated response\n\nsmb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob\nand loops for the next chunk. If the server reports\nSTATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns\n-E2BIG with out_data == NULL and out_data_len == 0, and the existing\nlength checks accept the empty result. The loop then evaluates\n\n\tnext = out_data[num - 1].file_offset + ...\n\nwith num == 0, reading 16 bytes before NULL.\n\nReject a truncated range blob that contains no range, so the resume\noffset is never computed from an empty response. Also require the last\nrange in a truncated blob to advance the resume offset without\noverflowing, and to stay within the requested range; a malicious or\nbroken server could otherwise make no progress or underflow len and loop\nforever. Free the previous response buffer before retrying.\n\nReproduced on 6.6.87.2 with a malicious SMB2 server that answers\nFSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and\nOutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in\ncifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged\non mainline.","summary":"A malicious or broken SMB server can send an empty truncated response that makes the Linux kernel's CIFS client read memory before a NULL pointer during an FS_IOC_FIEMAP call. The reproduced result is a kernel oops, which crashes the machine.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cifs","file-servers","linux-kernel","runtime","smb"],"not_affected_if":["no-cifs-mounts","trusted-smb-server"],"how_to_check":"- Check whether the kernel mounts SMB shares with `mount -t cifs` or `lsblk`-visible CIFS filesystems, using `findmnt -t cifs`\n- Check the running kernel version with `uname -r`\n- The sources do not list fixed kernel versions, so compare against your distribution's advisory","fix":null,"status":"open","published_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","triaged_at":"2026-11-07T14:49:55+00:00","updated_at":"2026-11-07T14:49:55+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-07T14:49:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel: malicious SMB server crashes client via fiemap read","impact":"low","summary":"A malicious or broken SMB server can send an empty truncated response that makes the Linux kernel's CIFS client read memory before a NULL pointer during an FS_IOC_FIEMAP call. The reproduced result is a kernel oops, which crashes the machine.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","cifs","smb","file-servers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Kernel oops from a hostile SMB server, crashing the machine","analyst_note":"Find the upstream kernel fix commit and the affected/fixed kernel version ranges from the NVD or kernel.org stable entries for CVE-2026-99274.","how_to_check":"- Check whether the kernel mounts SMB shares with `mount -t cifs` or `lsblk`-visible CIFS filesystems, using `findmnt -t cifs`\n- Check the running kernel version with `uname -r`\n- The sources do not list fixed kernel versions, so compare against your distribution's advisory","plain_action":"","needs_analyst":true,"not_affected_if":["no-cifs-mounts","trusted-smb-server"],"who_is_affected":"Systems that mount SMB/CIFS shares with the Linux kernel client and reach a server that a hostile party could control or man-in-the-middle. The sources reproduce the crash only through an FS_IOC_FIEMAP ioctl on a mounted share, so hosts that never mount SMB shares are not exposed. The sources do not say which kernel versions are affected beyond the reproduction on 6.6.87.2 and that the code path is unchanged on mainline.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000797,"input_tokens":4613,"output_tokens":672,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99274':13A,16A '0':116C,129C,152C,244C '1':147C '16':154C '6.6.87.2':226C 'accept':135C 'advanc':188C 'alloc':236C 'also':178C 'answer':233C 'blob':100C,162C,186C 'broken':29B,204C 'buffer':112C,221C,240C 'byte':155C 'call':57B 'check':134C 'chunk':106C 'cif':17B,44B,255C 'client':7A,45B,80C 'code':261C 'comput':173C 'contain':164C 'could':206C 'cr2':258C 'crash':6A,66B 'cve':11A,14A 'data':123C,127C,145C 'e2big':92C,120C 'empti':35B,86C,137C,176C 'evalu':142C 'exist':132C 'fffffffffffffff8':259C 'fiemap':9A,56B,82C,90C,248C,256C 'file':19B,148C 'file-serv':18B 'fix':81C 'follow':74C 'forev':216C 'free':217C 'fs':54B,246C 'fsctl':234C 'ioc':55B,247C 'ioctl':95C,118C,249C 'kernel':2A,23B,42B,63B,72C 'last':181C 'len':128C,213C 'length':133C 'linux':1A,22B,41B,71C 'linux-kernel':21B 'loop':102C,140C,215C 'machin':68B 'mainlin':266C 'make':39B,208C 'malici':3A,27B,202C,229C 'memori':47B 'mount':252C 'never':172C 'next':105C,143C 'null':50B,124C,157C 'num':146C,151C 'offset':149C,170C,191C 'oop':64B 'oops':253C 'otherwis':207C 'outputcount':115C,243C 'overflow':113C,193C,241C 'path':262C 'pointer':51B 'previous':219C 'progress':210C 'queri':235C 'rang':99C,161C,166C,182C,200C,237C 'read':10A,46B,84C,153C 'reject':158C 'report':110C 'reproduc':59B,224C 'request':199C 'requir':179C 'resolv':78C 'respons':37B,88C,177C,220C 'result':60B,138C 'resum':169C,190C 'retri':223C 'return':119C 'runtim':24B 'send':33B 'server':5A,20B,31B,109C,205C,231C 'smb':4A,25B,30B,79C 'smb2':94C,117C,230C 'smb3':89C 'status':111C,239C 'stay':196C 'treat':91C 'truncat':36B,87C,98C,160C,185C 'unchang':264C 'underflow':212C 'via':8A 'vulner':75C 'wild':83C 'within':197C 'without':192C","nicknames":[],"mitigations":[],"who_affected":"Systems that mount SMB/CIFS shares with the Linux kernel client and reach a server that a hostile party could control or man-in-the-middle. The sources reproduce the crash only through an FS_IOC_FIEMAP ioctl on a mounted share, so hosts that never mount SMB shares are not exposed. The sources do not say which kernel versions are affected beyond the reproduction on 6.6.87.2 and that the code path is unchanged on mainline.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cifs","fileservers","linuxkernel","runtime","smb","unknown"],"campaign_type":null,"search_a":"'-2026':12A,15A '-99274':13A,16A 'client':7A 'crash':6A 'cve':11A,14A 'fiemap':9A 'kernel':2A 'linux':1A 'malici':3A 'read':10A 'server':5A 'smb':4A 'via':8A","search_b":"'broken':29B 'call':57B 'cif':17B,44B 'client':45B 'crash':66B 'empti':35B 'fiemap':56B 'file':19B 'file-serv':18B 'fs':54B 'ioc':55B 'kernel':23B,42B,63B 'linux':22B,41B 'linux-kernel':21B 'machin':68B 'make':39B 'malici':27B 'memori':47B 'null':50B 'oop':64B 'pointer':51B 'read':46B 'reproduc':59B 'respons':37B 'result':60B 'runtim':24B 'send':33B 'server':20B,31B 'smb':25B,30B 'truncat':36B","search_c":"'0':116C,129C,152C,244C '1':147C '16':154C '6.6.87.2':226C 'accept':135C 'advanc':188C 'alloc':236C 'also':178C 'answer':233C 'blob':100C,162C,186C 'broken':204C 'buffer':112C,221C,240C 'byte':155C 'check':134C 'chunk':106C 'cif':255C 'client':80C 'code':261C 'comput':173C 'contain':164C 'could':206C 'cr2':258C 'data':123C,127C,145C 'e2big':92C,120C 'empti':86C,137C,176C 'evalu':142C 'exist':132C 'fffffffffffffff8':259C 'fiemap':82C,90C,248C,256C 'file':148C 'fix':81C 'follow':74C 'forev':216C 'free':217C 'fs':246C 'fsctl':234C 'ioc':247C 'ioctl':95C,118C,249C 'kernel':72C 'last':181C 'len':128C,213C 'length':133C 'linux':71C 'loop':102C,140C,215C 'mainlin':266C 'make':208C 'malici':202C,229C 'mount':252C 'never':172C 'next':105C,143C 'null':124C,157C 'num':146C,151C 'offset':149C,170C,191C 'oops':253C 'otherwis':207C 'outputcount':115C,243C 'overflow':113C,193C,241C 'path':262C 'previous':219C 'progress':210C 'queri':235C 'rang':99C,161C,166C,182C,200C,237C 'read':84C,153C 'reject':158C 'report':110C 'reproduc':224C 'request':199C 'requir':179C 'resolv':78C 'respons':88C,177C,220C 'result':138C 'resum':169C,190C 'retri':223C 'return':119C 'server':109C,205C,231C 'smb':79C 'smb2':94C,117C,230C 'smb3':89C 'status':111C,239C 'stay':196C 'treat':91C 'truncat':87C,98C,160C,185C 'unchang':264C 'underflow':212C 'vulner':75C 'wild':83C 'within':197C 'without':192C","first_public_at":"2026-11-07T14:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99274","severity":null,"published_at":"2026-11-07T14:17:02+00:00","modified_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","fetched_at":"2026-11-07T14:47:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}