CVE-2026-99083ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.21%, higher than 10% of scored CVEs.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.21% (percentile 10)
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 26, 2026
- First seen by InfoSec Signals
- Oct 23, 2026
Affected products
Linux Linux linux:linux (from the name) | 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 builds before 59c6dcc5dd9dafe764ca0d40525933b2be69b059; 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 builds before 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a; from 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 before 517404e157395d0f8da125ca956c566895dfcd06; 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 builds before 4722d06b2907585074252061b1024a696c1cfc23; 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 builds before 23a0be6a84a38ac169eeab49017934e8e27c65f0; 676392184785ace61e939831e7ca44a03d438c3b; ef572ffa8eb44111eed2925fbb2adca78bdcbf61; 2ba03cecb12ac7ac9e0170e251543c56832d9959; and 3 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059
- https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a
- https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06
- https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23
- https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.