CVE-2026-99272

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99272", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.404Z", "datePublished": "2026-11-07T14:08:45.332Z", "dateUpdated": "2026-11-07T14:08:45.332Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-07T14:08:45.332Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate the data area in SMB2_read()\n\nSMB2_read() copies le32_to_cpu(rsp->DataLength) bytes from\n(char *)rsp + rsp->DataOffset without checking that the range lies\nwithin the response actually received. A READ response with\nDataOffset == 0 makes smb2_get_data_area_len() zero the data length, so\nsmb2_check_message() accepts a frame as short as the fixed response,\nwhile SMB2_read() still uses the server-supplied DataLength, capped only\nby CIFS_MAX_MSGSIZE and the caller's length.\n\nA malicious server can answer the synchronous read used by the\nmfsymlinks (or SFU) symlink parser with an 81-byte READ response\ncarrying DataOffset 0 and DataLength 1067, making the client copy 1067\nbytes from a 448-byte receive object (KASAN slab-out-of-bounds; up to\n16 KiB in the general case).\n\nClamp a zero (or header-overlapping) DataOffset to read_rsp_size, as\nhandle_read_data() does for the asynchronous path, and reject the\nresponse unless DataOffset + DataLength fits within rsp_iov.iov_len.\nThe SMB1 helper was fixed the same way in 5be5bdda5863."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2pdu.c"], "versions": [{"version": "d8e050398d23ef7c019c96200b80d73f4e5cec0c", "lessThan": "1ba1937de005e261a8858f45bfef5da7458df94c", "status": "affected", "versionType": "git"}, {"version": "d8e050398d23ef7c019c96200b80d73f4e5cec0c", "lessThan": "2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2pdu.c"], "versions": [{"version": "3.7", "status": "affected"}, {"version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1ba1937de005e261a8858f45bfef5da7458df94c"}, {"url": "https://git.kernel.org/stable/c/2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1"}], "title": "smb: client: validate the data area in SMB2_read()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1ba1937de005e261a8858f45bfef5da7458df94c", "status": "affected", "version": "d8e050398d23ef7c019c96200b80d73f4e5cec0c", "versionType": "git"}, {"lessThan": "2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1", "status": "affected", "version": "d8e050398d23ef7c019c96200b80d73f4e5cec0c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"lessThan": "3.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate the data area in SMB2_read()\n\nSMB2_read() copies le32_to_cpu(rsp->DataLength) bytes from\n(char *)rsp + rsp->DataOffset without checking that the range lies\nwithin the response actually received. A READ response with\nDataOffset == 0 makes smb2_get_data_area_len() zero the data length, so\nsmb2_check_message() accepts a frame as short as the fixed response,\nwhile SMB2_read() still uses the server-supplied DataLength, capped only\nby CIFS_MAX_MSGSIZE and the caller's length.\n\nA malicious server can answer the synchronous read used by the\nmfsymlinks (or SFU) symlink parser with an 81-byte READ response\ncarrying DataOffset 0 and DataLength 1067, making the client copy 1067\nbytes from a 448-byte receive object (KASAN slab-out-of-bounds; up to\n16 KiB in the general case).\n\nClamp a zero (or header-overlapping) DataOffset to read_rsp_size, as\nhandle_read_data() does for the asynchronous path, and reject the\nresponse unless DataOffset + DataLength fits within rsp_iov.iov_len.\nThe SMB1 helper was fixed the same way in 5be5bdda5863."}], "id": "CVE-2026-99272", "lastModified": "2026-11-07T14:17:02.477", "metrics": {}, "published": "2026-11-07T14:17:02.477", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1ba1937de005e261a8858f45bfef5da7458df94c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: out-of-bounds read in SMB client via crafted read response", "id": "2568632", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568632"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's Server Message Block (SMB) client. The SMB2 read handler does not properly validate whether the data range specified by the server fits within the boundaries of the received packet. A malicious SMB server could exploit this vulnerability by sending a crafted read response with an invalid data offset and length, triggering an out-of-bounds memory read. This issue can lead to a system crash, resulting in a Denial of Service (DoS), or potentially expose sensitive kernel memory."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, prevent the cifs kernel module from loading if SMB client mounts are not required:\n1. Create a configuration file to prevent the module from being loaded:\necho \"install cifs /bin/true\" > /etc/modprobe.d/disable-cifs.conf\n2. If the module is currently loaded, unmount all active CIFS shares and attempt to remove it:\nmodprobe -r cifs\nWarning: Unloading the kernel module will terminate active SMB connections, and a system reboot may be required to fully ensure the module remains unloaded if it is currently held in use by running processes.\nCaveats:\nDisabling the cifs module prevents the system from mounting remote SMB/CIFS file shares. If SMB client functionality is business-critical, ensure mounts are strictly restricted to trusted internal SMB servers."}, "name": "CVE-2026-99272", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-07T14:08:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99272\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99272\nhttps://git.kernel.org/stable/c/1ba1937de005e261a8858f45bfef5da7458df94c\nhttps://git.kernel.org/stable/c/2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1"], "statement": "This vulnerability is rated as Important because a rogue or compromised SMB server can induce a kernel-space slab out-of-bounds read, leading directly to a client system crash or potential memory disclosure. Exploitation depends on a user or automated process initiating file operations against an untrusted network share, limiting the attack surface to active CIFS client connections. Red Hat Enterprise Linux systems that do not mount remote SMB shares or that restrict mounts to trusted internal infrastructure are not vulnerable to external exploitation.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d8e050398d23ef7c019c96200b80d73f4e5cec0c,1ba1937de005e261a8858f45bfef5da7458df94c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d8e050398d23ef7c019c96200b80d73f4e5cec0c,2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d8e050398d23ef7c019c96200b80d73f4e5cec0c,1ba1937de005e261a8858f45bfef5da7458df94c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d8e050398d23ef7c019c96200b80d73f4e5cec0c,2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-07T16:00:17.571842+00:00", "updated": "2026-11-08T02:00:13.876599+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}