CVE-2026-99083 is a vulnerability in Linux Kernel
Published on October 23, 2026
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.
Products Associated with CVE-2026-99083
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 59c6dcc5dd9dafe764ca0d40525933b2be69b059 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 517404e157395d0f8da125ca956c566895dfcd06 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 4722d06b2907585074252061b1024a696c1cfc23 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 23a0be6a84a38ac169eeab49017934e8e27c65f0 is affected.
- Before 6.6.160 is affected.
- Before 6.12.114 is affected.
- Before 6.18.58 is affected.
- Before 7.2.12 is affected.
- Version 6.6.160, <= 6.6.* is unaffected.
- Version 6.12.114, <= 6.12.* is unaffected.
- Version 6.18.58, <= 6.18.* is unaffected.
- Version 7.2.12, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.