---
id: "CVE-2026-99275"
page: "https://infrastack.ai/live/CVE-2026-99275"
kind: "vulnerability"
aliases: ["CVE-2026-99275"]
title: "Linux kernel SMB client reads stale memory from a crafted server reply"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "linux-kernel", "fixed": ["7.4-rc1"], "affected": "all supported stable trees per patch author (reproduced on 6.6.87.2); predates 2016 commit 166cea4dc3a4", "ecosystem": "linux"}]
ecosystems: []
tags: ["cifs", "linux-kernel", "runtime", "self-hosted", "smb-client"]
not_affected_if: ["cifs-module-not-loaded", "no-smb-mounts"]
published_at: "2026-11-07T14:17:02+00:00"
first_seen_at: "2026-11-07T14:47:40+00:00"
updated_at: "2026-11-07T14:50:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99275", "first_seen_at": "2026-11-07T14:47:40+00:00"}, {"source": "analyst", "url": "https://lists.openwall.net/linux-kernel/2026/10/22/267", "first_seen_at": "2026-11-07T14:50:50+00:00", "cites": ["https://lists.openwall.net/linux-kernel/2026/10/22/267", "https://lists.openwall.net/linux-kernel/2026/10/30/2823", "https://lists.openwall.net/linux-kernel/2026/11/05/147"]}]
exploit_sources: []
---

# Linux kernel SMB client reads stale memory from a crafted server reply

Link for people: https://infrastack.ai/live/CVE-2026-99275 (this .md is for agents)

A malicious or compromised SMB server can send a short SESSION_SETUP reply that makes the Linux kernel's CIFS client read leftover bytes from its receive buffer. Those bytes are sent back to the server in the authentication step, leaking up to about 64 KB of kernel memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- linux:linux-kernel affected all supported stable trees per patch author (reproduced on 6.6.87.2); predates 2016 commit 166cea4dc3a4 fixed 7.4-rc1

## How to check

- Run `uname -r`. Fixed in mainline 7.4-rc1; for stable branches, check that your distro kernel changelog lists 'smb: client: reject short SESSION_SETUP responses'.
- Run `lsmod | grep cifs`; if the module is not loaded and nothing mounts SMB shares, the path is not reachable.
- Run `findmnt -t cifs` to list active SMB mounts and which servers they talk to.

## Fix

Fixed upstream by 'smb: client: reject short SESSION_SETUP responses', merged for mainline 7.4-rc1 (cifs-fixes-7.4-rc1 pull, marked for stable). Also queued in the 7.3.2-rc1 stable review (not confirmed released). Other stable release numbers: unknown. Until you can update, avoid mounting SMB shares from untrusted servers.

## Timeline

- 2026-11-07T14:47:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99275
- 2026-11-07T14:50:50+00:00 analyst https://lists.openwall.net/linux-kernel/2026/10/22/267 — Patch by Abdifatah Suruur, reviewed by Namjae Jeon, applied by Paulo Alcantara, in cifs-fixes-7.4-rc1 pull (10/30); in 7.3.2-rc1 stable review (11/5). Author says all supported stable trees affected, reproduced on 6.6.87.2. No released stable version numbers found, so fix not verified. Commit hashes not found; only lore/openwall mail.

## Documents

- [advisory] [PATCH] smb: client: reject short SESSION_SETUP responses https://lists.openwall.net/linux-kernel/2026/10/22/267
- [fix] [GIT PULL] smb client fixes for 7.4-rc1 https://lists.openwall.net/linux-kernel/2026/10/30/2823
- [fix] [PATCH 7.3 000/547] 7.3.2-rc1 review https://lists.openwall.net/linux-kernel/2026/11/05/147

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject short SESSION_SETUP responses

smb2_check_message() accepts frames shorter than struct smb2_pdu when
the SMB2 status is non-zero, before the minimum-PDU check added by
b4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP
response is therefore accepted even though it cannot contain the
SecurityBufferOffset and SecurityBufferLength fields.

The parser then reads those fields from stale bytes left in the reused
receive buffer by an earlier frame. With a long stale
SecurityBufferLength, decode_ntlmssp_challenge() copies up to about
64 KB from beyond the receive object and sends the data back to the
server in the NTLMv2 AUTHENTICATE target info.

Reject short MPR SESSION_SETUP responses before the short-error path,
and validate SecurityBufferOffset + SecurityBufferLength against the
received response length before decoding the challenge.

The ordering bypass is not new: the short-error early return predates
b4694f269e66d, and the unvalidated SecurityBufferLength read predates
the 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable
trees are affected. Reproduced on 6.6.87.2; the path is unchanged on
mainline.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_