All vulnerabilities
CVE-2026-99114

Linux: ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION

Linux LinuxOperating systems
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in03bb4338c3a7c3fc4decf699a35753f0891aab2aFixed versionCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 03bb4338c3a7c3fc4decf699a35753f0891aab2aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION

smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, but never assigns FileSystemControlFlags. Those four bytes go to the client as they are found in the response buffer.

The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2_set_err_rsp() stays there, and the next reply is laid over it with only the header cleared.

ksmbd does not implement quota tracking, so report no control flags.

Text from CVE List

Affected versions 8

  • Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before d8c450ad0d08980b39b08d435efa921086c8b227CVE List
  • Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before 03bb4338c3a7c3fc4decf699a35753f0891aab2aCVE List
  • Linuxaffected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 before c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8eCVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3