---
id: "CVE-2026-99274"
page: "https://infrastack.ai/live/CVE-2026-99274"
kind: "vulnerability"
aliases: ["CVE-2026-99274"]
title: "Linux kernel: malicious SMB server crashes client via fiemap read"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cifs", "file-servers", "linux-kernel", "runtime", "smb"]
not_affected_if: ["no-cifs-mounts", "trusted-smb-server"]
published_at: "2026-11-07T14:17:02+00:00"
first_seen_at: "2026-11-07T14:47:40+00:00"
updated_at: "2026-11-07T14:49:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99274", "first_seen_at": "2026-11-07T14:47:40+00:00"}]
exploit_sources: []
---

# Linux kernel: malicious SMB server crashes client via fiemap read

Link for people: https://infrastack.ai/live/CVE-2026-99274 (this .md is for agents)

A malicious or broken SMB server can send an empty truncated response that makes the Linux kernel's CIFS client read memory before a NULL pointer during an FS_IOC_FIEMAP call. The reproduced result is a kernel oops, which crashes the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the kernel mounts SMB shares with `mount -t cifs` or `lsblk`-visible CIFS filesystems, using `findmnt -t cifs`
- Check the running kernel version with `uname -r`
- The sources do not list fixed kernel versions, so compare against your distribution's advisory

## Timeline

- 2026-11-07T14:47:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99274

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix fiemap wild read on empty truncated response

smb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob
and loops for the next chunk. If the server reports
STATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns
-E2BIG with out_data == NULL and out_data_len == 0, and the existing
length checks accept the empty result. The loop then evaluates

	next = out_data[num - 1].file_offset + ...

with num == 0, reading 16 bytes before NULL.

Reject a truncated range blob that contains no range, so the resume
offset is never computed from an empty response. Also require the last
range in a truncated blob to advance the resume offset without
overflowing, and to stay within the requested range; a malicious or
broken server could otherwise make no progress or underflow len and loop
forever. Free the previous response buffer before retrying.

Reproduced on 6.6.87.2 with a malicious SMB2 server that answers
FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and
OutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in
cifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged
on mainline.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_