CVE-2026-99083

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

State: Published
Severity: 8.8 High
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.

This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory.

Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	676392184785ace61e939831e7ca44a03d438c3b to before a07dfb33112a42437f9d2d0bfd35c68575257381Affected ef572ffa8eb44111eed2925fbb2adca78bdcbf61 to before 1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ffAffected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 59c6dcc5dd9dafe764ca0d40525933b2be69b059Affected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27aAffected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 517404e157395d0f8da125ca956c566895dfcd06Affected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 4722d06b2907585074252061b1024a696c1cfc23Affected 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 23a0be6a84a38ac169eeab49017934e8e27c65f0Affected 2ba03cecb12ac7ac9e0170e251543c56832d9959Affected 5.15.145 to before 5.15.224Affected 6.1.40 to before 6.1.191Affected 6.4.5 to before 6.5Affected
LinuxLinux	6.5Affected before 6.5Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.58 through 6.18.Not affected 7.2.12 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

676392184785ace61e939831e7ca44a03d438c3b to before a07dfb33112a42437f9d2d0bfd35c68575257381Affected
ef572ffa8eb44111eed2925fbb2adca78bdcbf61 to before 1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ffAffected
98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 59c6dcc5dd9dafe764ca0d40525933b2be69b059Affected
98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27aAffected
98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 517404e157395d0f8da125ca956c566895dfcd06Affected
98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 4722d06b2907585074252061b1024a696c1cfc23Affected
98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 to before 23a0be6a84a38ac169eeab49017934e8e27c65f0Affected
2ba03cecb12ac7ac9e0170e251543c56832d9959Affected
5.15.145 to before 5.15.224Affected
6.1.40 to before 6.1.191Affected
6.4.5 to before 6.5Affected

LinuxLinux

6.5Affected
before 6.5Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.58 through 6.18.*Not affected
7.2.12 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.