All vulnerabilities
CVE-2026-99083

Linux: ksmbd: fix heap out-of-bounds write in krb5_authenticate()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in59c6dcc5dd9dafe764ca0d40525933b2be69b059Also 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a, 517404e157395d0f8da125ca956c566895dfcd06 and 6 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 59c6dcc5dd9dafe764ca0d40525933b2be69b059LinuxCVE List
  • 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27aLinuxCVE List
  • 517404e157395d0f8da125ca956c566895dfcd06LinuxCVE List
  • 4722d06b2907585074252061b1024a696c1cfc23LinuxCVE List
  • 23a0be6a84a38ac169eeab49017934e8e27c65f0LinuxCVE List
  • 6.6.160LinuxCVE List
Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.

This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory.

Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.

Text from CVE List

Affected versions 14

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 59c6dcc5dd9dafe764ca0d40525933b2be69b059CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27aCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 517404e157395d0f8da125ca956c566895dfcd06CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4722d06b2907585074252061b1024a696c1cfc23CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 23a0be6a84a38ac169eeab49017934e8e27c65f0CVE List
  • Linuxaffected: all versions before 6.6.160CVE List
  • Linuxaffected: all versions before 6.12.114CVE List
  • Linuxaffected: all versions before 6.18.58CVE List
  • Linuxaffected: all versions before 7.2.12CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.58 through 6.18.*CVE List
  • Linuxunaffected: 7.2.12 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5