LINUX-KERNEL · CVE-2026-99275 · Runtime
FIX → 7.4-rc1
A malicious or compromised SMB server can send a short SESSION_SETUP reply that makes the Linux kernel's CIFS client read leftover bytes from its receive buffer. Those bytes are sent back to the server in the authentication step, leaking up to about 64 KB of kernel memory.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Systems running a Linux kernel with the CIFS/SMB client that mount or connect to SMB shares, especially to servers that are not fully trusted. The sources state that all supported stable trees are affected and that the path is unchanged on mainline. Systems without the SMB client module loaded, or that never connect to SMB servers, are unlikely to be exposed.
Not affected if cifs-module-not-loaded, no-smb-mounts
Who cares cifs, linux-kernel, self-hosted, smb-client
uname -r. Fixed in mainline 7.4-rc1; for stable branches, check that your distro kernel changelog lists 'smb: client: reject short SESSION_SETUP responses'.lsmod | grep cifs; if the module is not loaded and nothing mounts SMB shares, the path is not reachable.findmnt -t cifs to list active SMB mounts and which servers they talk to.Upgrade to 7.4-rc1
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject short SESSION_SETUP responses
smb2_check_message() accepts frames shorter than struct smb2_pdu when the SMB2 status is non-zero, before the minimum-PDU check added by b4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP response is therefore accepted even though it cannot contain the SecurityBufferOffset and SecurityBufferLength fields.
The parser then reads those fields from stale bytes left in the reused receive buffer by an earlier frame. With a long stale SecurityBufferLength, decode_ntlmssp_challenge() copies up to about 64 KB from beyond the receive object and sends the data back to the server in the NTLMv2 AUTHENTICATE target info.
Reject short MPR SESSION_SETUP responses before the short-error path, and validate SecurityBufferOffset + SecurityBufferLength against the received response length before decoding the challenge.
The ordering bypass is not new: the short-error early return predates b4694f269e66d, and the unvalidated SecurityBufferLength read predates the 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable trees are affected. Reproduced on 6.6.87.2; the path is unchanged on mainline.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
smb: client: reject short SESSION_SETUP responses, merged for mainline 7.4-rc1 (cifs-fixes-7.4-rc1 pull, marked for stable)7.3.2-rc1 stable review (not confirmed released)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.