ksmbd: fix heap out-of-bounds write in krb5_authenticate()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99083
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-23 13:17:32 UTC
Updated2026-10-26 07:17:18 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.

Risk And Classification

Primary CVSS: v3.1 8.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED8.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 59c6dcc5dd9dafe764ca0d40525933b2be69b059 git Not specified
CNA Linux Linux affected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a git Not specified
CNA Linux Linux affected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 517404e157395d0f8da125ca956c566895dfcd06 git Not specified
CNA Linux Linux affected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 4722d06b2907585074252061b1024a696c1cfc23 git Not specified
CNA Linux Linux affected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 23a0be6a84a38ac169eeab49017934e8e27c65f0 git Not specified
CNA Linux Linux affected 676392184785ace61e939831e7ca44a03d438c3b git Not specified
CNA Linux Linux affected ef572ffa8eb44111eed2925fbb2adca78bdcbf61 git Not specified
CNA Linux Linux affected 2ba03cecb12ac7ac9e0170e251543c56832d9959 git Not specified
CNA Linux Linux affected 5.15.145 5.16 semver Not specified
CNA Linux Linux affected 6.1.40 6.2 semver Not specified
CNA Linux Linux affected 6.4.5 6.5 semver Not specified
CNA Linux Linux affected 6.5 Not specified
CNA Linux Linux unaffected 6.5 semver Not specified
CNA Linux Linux unaffected 6.6.160 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.114 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.58 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.12 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report