{"id":"CVE-2026-99275","kind":"vulnerability","aliases":["CVE-2026-99275"],"related":[],"title":"Linux kernel SMB client reads stale memory from a crafted server reply","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject short SESSION_SETUP responses\n\nsmb2_check_message() accepts frames shorter than struct smb2_pdu when\nthe SMB2 status is non-zero, before the minimum-PDU check added by\nb4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP\nresponse is therefore accepted even though it cannot contain the\nSecurityBufferOffset and SecurityBufferLength fields.\n\nThe parser then reads those fields from stale bytes left in the reused\nreceive buffer by an earlier frame. With a long stale\nSecurityBufferLength, decode_ntlmssp_challenge() copies up to about\n64 KB from beyond the receive object and sends the data back to the\nserver in the NTLMv2 AUTHENTICATE target info.\n\nReject short MPR SESSION_SETUP responses before the short-error path,\nand validate SecurityBufferOffset + SecurityBufferLength against the\nreceived response length before decoding the challenge.\n\nThe ordering bypass is not new: the short-error early return predates\nb4694f269e66d, and the unvalidated SecurityBufferLength read predates\nthe 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable\ntrees are affected. Reproduced on 6.6.87.2; the path is unchanged on\nmainline.","summary":"A malicious or compromised SMB server can send a short SESSION_SETUP reply that makes the Linux kernel's CIFS client read leftover bytes from its receive buffer. Those bytes are sent back to the server in the authentication step, leaking up to about 64 KB of kernel memory.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"linux-kernel","fixed":["7.4-rc1"],"affected":"all supported stable trees per patch author (reproduced on 6.6.87.2); predates 2016 commit 166cea4dc3a4","ecosystem":"linux"}],"ecosystems":[],"tags":["cifs","linux-kernel","runtime","self-hosted","smb-client"],"not_affected_if":["cifs-module-not-loaded","no-smb-mounts"],"how_to_check":"- Run `uname -r`. Fixed in mainline 7.4-rc1; for stable branches, check that your distro kernel changelog lists 'smb: client: reject short SESSION_SETUP responses'.\n- Run `lsmod | grep cifs`; if the module is not loaded and nothing mounts SMB shares, the path is not reachable.\n- Run `findmnt -t cifs` to list active SMB mounts and which servers they talk to.","fix":"Fixed upstream by 'smb: client: reject short SESSION_SETUP responses', merged for mainline 7.4-rc1 (cifs-fixes-7.4-rc1 pull, marked for stable). Also queued in the 7.3.2-rc1 stable review (not confirmed released). Other stable release numbers: unknown. Until you can update, avoid mounting SMB shares from untrusted servers.","status":"open","published_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","triaged_at":"2026-11-07T14:49:54+00:00","updated_at":"2026-11-07T14:50:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-07T14:49:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel SMB client reads stale memory from a crafted server reply","impact":"medium","summary":"A malicious or compromised SMB server can send a short SESSION_SETUP reply that makes the Linux kernel's CIFS client read leftover bytes from its receive buffer. Those bytes are sent back to the server in the authentication step, leaking up to about 64 KB of kernel memory.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","smb-client","cifs","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"server reads up to 64 KB of kernel memory leaked","analyst_note":"Find the fixed kernel versions in the upstream stable commits for b4694f269e66d and 166cea4dc3a4 and confirm the fix commit; the NVD entry gave no severity or ranges.","how_to_check":"- Check the kernel version with `uname -r` and compare it against the fixed kernel releases from the upstream stable tree.\n- Check whether the CIFS/SMB client module is loaded with `lsmod | grep cifs`; if it is not loaded, the path is not reachable.\n- unknown for the exact fixed versions, since the sources give none.","plain_action":"","needs_analyst":true,"not_affected_if":["no-smb-mounts","cifs-module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the CIFS/SMB client that mount or connect to SMB shares, especially to servers that are not fully trusted. The sources state that all supported stable trees are affected and that the path is unchanged on mainline. Systems without the SMB client module loaded, or that never connect to SMB servers, are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4602,"output_tokens":663,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed kernel versions in the upstream stable commits for b4694f269e66d and 166cea4dc3a4 and confirm the fix commit; the NVD entry gave no severity or ranges.","search":"'-2026':14A,17A '-99275':15A,18A '166cea4dc3a4':252C '2016':247C '6.6.87.2':262C '64':77B,127C,180C 'accept':102C,138C 'add':123C 'affect':259C 'authent':71B,198C 'b4694f269e66d':125C,239C 'back':65B,191C 'beyond':183C 'buffer':60B,163C 'bypass':228C 'byte':56B,62B,128C,157C 'cannot':142C 'challeng':175C,225C 'check':100C,122C 'cif':22B,52B 'client':4A,32B,53B,93C 'compromis':36B 'contain':143C 'copi':176C 'craft':10A 'cve':13A,16A 'data':190C 'decod':173C,223C 'earli':236C 'earlier':166C 'error':211C,235C 'even':139C 'field':148C,154C 'follow':87C 'frame':103C,167C 'host':29B 'info':200C 'kb':78B,181C 'kernel':2A,21A,25B,50B,80B,85C 'leak':73B 'left':158C 'leftov':55B 'length':221C 'linux':1A,20A,24B,49B,84C 'linux-kernel':19A,23B 'long':170C 'mainlin':268C 'make':47B 'malici':34B 'memori':7A,81B 'messag':101C 'minimum':120C 'minimum-pdu':119C 'mpr':203C 'new':231C 'non':115C 'non-zero':114C 'ntlmssp':174C,249C 'ntlmv2':197C 'object':186C 'order':227C 'parser':150C 'path':212C,264C 'pdu':108C,121C 'predat':238C,245C 'process':131C 'raw':248C 'read':5A,54B,152C,244C 'receiv':59B,162C,185C,219C 'reject':94C,201C 'repli':12A,45B 'reproduc':260C 'requir':132C 'resolv':91C 'respons':98C,135C,206C,220C 'return':237C 'reus':161C 'runtim':26B 'securitybufferlength':147C,172C,216C,243C 'securitybufferoffset':145C,215C 'self':28B 'self-host':27B 'send':40B,188C 'sent':64B 'server':11A,38B,68B,194C 'session':43B,96C,133C,204C 'setup':44B,97C,134C,205C 'short':42B,95C,202C,210C,234C 'short-error':209C,233C 'shorter':104C 'smb':3A,31B,37B,92C 'smb-client':30B 'smb2':99C,107C,111C 'split':250C 'stabl':256C 'stale':6A,156C,171C 'status':112C,129C 'step':72B 'struct':106C 'support':255C 'target':199C 'therefor':137C 'though':140C 'tree':257C 'unchang':266C 'unvalid':242C 'valid':214C 'vulner':88C 'zero':116C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the CIFS/SMB client that mount or connect to SMB shares, especially to servers that are not fully trusted. The sources state that all supported stable trees are affected and that the path is unchanged on mainline. Systems without the SMB client module loaded, or that never connect to SMB servers, are unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["linuxkernel"],"ptokens":["kernel","linux"],"labels":["cifs","high","linuxkernel","runtime","selfhosted","smbclient"],"campaign_type":null,"search_a":"'-2026':14A,17A '-99275':15A,18A 'client':4A 'craft':10A 'cve':13A,16A 'kernel':2A,21A 'linux':1A,20A 'linux-kernel':19A 'memori':7A 'read':5A 'repli':12A 'server':11A 'smb':3A 'stale':6A","search_b":"'64':77B 'authent':71B 'back':65B 'buffer':60B 'byte':56B,62B 'cif':22B,52B 'client':32B,53B 'compromis':36B 'host':29B 'kb':78B 'kernel':25B,50B,80B 'leak':73B 'leftov':55B 'linux':24B,49B 'linux-kernel':23B 'make':47B 'malici':34B 'memori':81B 'read':54B 'receiv':59B 'repli':45B 'runtim':26B 'self':28B 'self-host':27B 'send':40B 'sent':64B 'server':38B,68B 'session':43B 'setup':44B 'short':42B 'smb':31B,37B 'smb-client':30B 'step':72B","search_c":"'166cea4dc3a4':252C '2016':247C '6.6.87.2':262C '64':127C,180C 'accept':102C,138C 'add':123C 'affect':259C 'authent':198C 'b4694f269e66d':125C,239C 'back':191C 'beyond':183C 'buffer':163C 'bypass':228C 'byte':128C,157C 'cannot':142C 'challeng':175C,225C 'check':100C,122C 'client':93C 'contain':143C 'copi':176C 'data':190C 'decod':173C,223C 'earli':236C 'earlier':166C 'error':211C,235C 'even':139C 'field':148C,154C 'follow':87C 'frame':103C,167C 'info':200C 'kb':181C 'kernel':85C 'left':158C 'length':221C 'linux':84C 'long':170C 'mainlin':268C 'messag':101C 'minimum':120C 'minimum-pdu':119C 'mpr':203C 'new':231C 'non':115C 'non-zero':114C 'ntlmssp':174C,249C 'ntlmv2':197C 'object':186C 'order':227C 'parser':150C 'path':212C,264C 'pdu':108C,121C 'predat':238C,245C 'process':131C 'raw':248C 'read':152C,244C 'receiv':162C,185C,219C 'reject':94C,201C 'reproduc':260C 'requir':132C 'resolv':91C 'respons':98C,135C,206C,220C 'return':237C 'reus':161C 'securitybufferlength':147C,172C,216C,243C 'securitybufferoffset':145C,215C 'send':188C 'server':194C 'session':96C,133C,204C 'setup':97C,134C,205C 'short':95C,202C,210C,234C 'short-error':209C,233C 'shorter':104C 'smb':92C 'smb2':99C,107C,111C 'split':250C 'stabl':256C 'stale':156C,171C 'status':112C,129C 'struct':106C 'support':255C 'target':199C 'therefor':137C 'though':140C 'tree':257C 'unchang':266C 'unvalid':242C 'valid':214C 'vulner':88C 'zero':116C","first_public_at":"2026-11-07T14:17:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99275","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99275","severity":null,"published_at":"2026-11-07T14:17:02+00:00","modified_at":"2026-11-07T14:17:02+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","fetched_at":"2026-11-07T14:47:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99275:2130","url":"https://lists.openwall.net/linux-kernel/2026/10/22/267","severity":null,"published_at":"2026-11-07T14:50:50+00:00","modified_at":"2026-11-07T14:50:50+00:00","first_seen_at":"2026-11-07T14:50:50+00:00","fetched_at":"2026-11-07T14:50:50+00:00","note":"Patch by Abdifatah Suruur, reviewed by Namjae Jeon, applied by Paulo Alcantara, in cifs-fixes-7.4-rc1 pull (10/30); in 7.3.2-rc1 stable review (11/5). Author says all supported stable trees affected, reproduced on 6.6.87.2. No released stable version numbers found, so fix not verified. Commit hashes not found; only lore/openwall mail.","cites":["https://lists.openwall.net/linux-kernel/2026/10/22/267","https://lists.openwall.net/linux-kernel/2026/10/30/2823","https://lists.openwall.net/linux-kernel/2026/11/05/147"]}],"documents":[{"id":96186,"url":"https://lists.openwall.net/linux-kernel/2026/10/22/267","title":"[PATCH] smb: client: reject short SESSION_SETUP responses","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":96187,"url":"https://lists.openwall.net/linux-kernel/2026/10/30/2823","title":"[GIT PULL] smb client fixes for 7.4-rc1","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":96188,"url":"https://lists.openwall.net/linux-kernel/2026/11/05/147","title":"[PATCH 7.3 000/547] 7.3.2-rc1 review","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}