CVE-2026-99083 - Vulnerability Details

- ksmbd: fix heap out-of-bounds write in krb5_authenticate()

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.

This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.

Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.

Published: 2026-10-23

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises from an incorrect calculation of the available buffer space in the ksmbd Kerberos authentication routine. When an SMB2_SESSION_SETUP message is processed as part of a compound SMB2 request, the calculation of out_len omits the offset of the next response header, causing the length check to pass incorrectly. As a result, a memcpy writes the Kerberos AP-REP blob past the end of response_buf, corrupting adjacent kernel heap memory. This out‑of‑bounds heap write can overwrite critical kernel data structures, potentially enabling an attacker to execute arbitrary code with kernel privileges.

Affected Systems

All Linux distributions that ship the standard Linux kernel with the ksmbd SMB daemon enabled are affected. This includes any system running a generic Linux kernel that includes ksmbd.

Risk and Exploitability

With a CVSS score of 8.8, the vulnerability is classified as high severity, reflecting the risk of kernel memory corruption. The EPSS score is less than 1% (approximately 0.4%), indicating a very low but nonzero probability of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that a remote attacker can send a crafted SMB2 compound request to a vulnerable host without requiring authentication or elevated privileges. Given the nature of the out‑of‑bounds write and the remote access vector, organizations running exposed SMB services should consider this a significant risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`676392184785ace61e939831e7ca44a03d438c3b`	affected	< a07dfb33112a42437f9d2d0bfd35c68575257381
`ef572ffa8eb44111eed2925fbb2adca78bdcbf61`	affected	< 1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff
`98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8`	affected	< 59c6dcc5dd9dafe764ca0d40525933b2be69b059
`98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8`	affected	< 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a
`98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8`	affected	< 517404e157395d0f8da125ca956c566895dfcd06
`98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8`	affected	< 4722d06b2907585074252061b1024a696c1cfc23
`98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8`	affected	< 23a0be6a84a38ac169eeab49017934e8e27c65f0
`2ba03cecb12ac7ac9e0170e251543c56832d9959`	affected	—
`5.15.145`	affected	< 5.15.224
`6.1.40`	affected	< 6.1.191
`6.4.5`	affected	< 6.5

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`6.18.58`	unaffected	≤ 6.18.*
`7.2.12`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,59c6dcc5dd9dafe764ca0d40525933b2be69b059)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,517404e157395d0f8da125ca956c566895dfcd06)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4722d06b2907585074252061b1024a696c1cfc23)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,23a0be6a84a38ac169eeab49017934e8e27c65f0)`	affected	generic	—
`[0,6.6.160)`	affected	semver	—
`[0,6.12.114)`	affected	semver	—
`[0,6.18.58)`	affected	semver	—
`[0,7.2.12)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.114,6.13.0)`	unaffected	semver	—
`[6.18.58,6.19.0)`	unaffected	semver	—
`[7.2.12,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,59c6dcc5dd9dafe764ca0d40525933b2be69b059)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,517404e157395d0f8da125ca956c566895dfcd06)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4722d06b2907585074252061b1024a696c1cfc23)`	affected	generic	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,23a0be6a84a38ac169eeab49017934e8e27c65f0)`	affected	generic	—
`[0,6.6.160)`	affected	semver	—
`[0,6.12.114)`	affected	semver	—
`[0,6.18.58)`	affected	semver	—
`[0,7.2.12)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.114,6.13.0)`	unaffected	semver	—
`[6.18.58,6.19.0)`	unaffected	semver	—
`[7.2.12,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the ksmbd bug fix.
Disable the ksmbd module if SMB services are not required.
Restrict SMB traffic to trusted networks and consider firewall rules that block SMB2 traffic from untrusted sources.

Generated by OpenCVE AI on October 27, 2026 at 10:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00445.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99083.mbox
https://git.kernel.org/stable/c/1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff
https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0
https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23
https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06
https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059
https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a
https://git.kernel.org/stable/c/a07dfb33112a42437f9d2d0bfd35c68575257381
https://nvd.nist.gov/vuln/detail/CVE-2026-99083
https://www.cve.org/CVERecord?id=CVE-2026-99083

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff https://git.kernel.org/stable/c/a07dfb33112a42437f9d2d0bfd35c68575257381

Tue, 27 Oct 2026 09:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Tue, 27 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99083.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99083 https://www.cve.org/CVERecord?id=CVE-2026-99083
Metrics	threat_severity `None`	threat_severity `Critical`

Sat, 24 Oct 2026 19:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Sat, 24 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119

Sat, 24 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 24 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119

Fri, 23 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
Title		ksmbd: fix heap out-of-bounds write in krb5_authenticate()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0 https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23 https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06 https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059 https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:45:01.735Z

Updated: 2026-10-30T12:41:38.581Z

Reserved: 2026-09-25T10:25:14.390Z

Link: CVE-2026-99083

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:32.577

Modified: 2026-10-30T13:21:44.380

Link: CVE-2026-99083

Redhat

Severity : Critical

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99083 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T10:45:06Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object