CVE-2026-99114

ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION

State: Published
Severity: Not scored
Published: Oct 28, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION

smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, but never assigns FileSystemControlFlags. Those four bytes go to the client as they are found in the response buffer.

The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2_set_err_rsp() stays there, and the next reply is laid over it with only the header cleared.

ksmbd does not implement quota tracking, so report no control flags.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 995456b5e703e128904a6cbc8b3347eb3d04c72cAffected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before c78aea8984c84767e87f677477e4784deb8adfdeAffected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before e8b82184a1982894820a91a72ac9857ddd5dffbfAffected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 370459776468fc68c97008360108f381e3120953Affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before d8c450ad0d08980b39b08d435efa921086c8b227Affected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 03bb4338c3a7c3fc4decf699a35753f0891aab2aAffected e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8eAffected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.161 through 6.6.Not affected 6.12.115 through 6.12.Not affected 6.18.59 through 6.18.Not affected 7.2.13 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 995456b5e703e128904a6cbc8b3347eb3d04c72cAffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before c78aea8984c84767e87f677477e4784deb8adfdeAffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before e8b82184a1982894820a91a72ac9857ddd5dffbfAffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 370459776468fc68c97008360108f381e3120953Affected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before d8c450ad0d08980b39b08d435efa921086c8b227Affected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before 03bb4338c3a7c3fc4decf699a35753f0891aab2aAffected
e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 to before c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8eAffected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.161 through 6.6.*Not affected
6.12.115 through 6.12.*Not affected
6.18.59 through 6.18.*Not affected
7.2.13 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.