CVE-2026-99274

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99274", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-07T14:08:45.924Z", "dateUpdated": "2026-11-10T18:15:27.974Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:27.974Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix fiemap wild read on empty truncated response\n\nsmb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob\nand loops for the next chunk. If the server reports\nSTATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns\n-E2BIG with out_data == NULL and out_data_len == 0, and the existing\nlength checks accept the empty result. The loop then evaluates\n\n\tnext = out_data[num - 1].file_offset + ...\n\nwith num == 0, reading 16 bytes before NULL.\n\nReject a truncated range blob that contains no range, so the resume\noffset is never computed from an empty response. Also require the last\nrange in a truncated blob to advance the resume offset without\noverflowing, and to stay within the requested range; a malicious or\nbroken server could otherwise make no progress or underflow len and loop\nforever. Free the previous response buffer before retrying.\n\nReproduced on 6.6.87.2 with a malicious SMB2 server that answers\nFSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and\nOutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in\ncifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged\non mainline."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "lessThan": "8e0d425b808c367f5033eb72aa4528ae18473627", "status": "affected", "versionType": "git"}, {"version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "lessThan": "4a426ca5be7e3dedbe76575b967db04fbf01136f", "status": "affected", "versionType": "git"}, {"version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "lessThan": "31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca", "status": "affected", "versionType": "git"}, {"version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "lessThan": "f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.61", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8e0d425b808c367f5033eb72aa4528ae18473627"}, {"url": "https://git.kernel.org/stable/c/4a426ca5be7e3dedbe76575b967db04fbf01136f"}, {"url": "https://git.kernel.org/stable/c/31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca"}, {"url": "https://git.kernel.org/stable/c/f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc"}], "title": "smb: client: fix fiemap wild read on empty truncated response", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8e0d425b808c367f5033eb72aa4528ae18473627", "status": "affected", "version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "versionType": "git"}, {"lessThan": "4a426ca5be7e3dedbe76575b967db04fbf01136f", "status": "affected", "version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "versionType": "git"}, {"lessThan": "31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca", "status": "affected", "version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "versionType": "git"}, {"lessThan": "f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc", "status": "affected", "version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2ops.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.61", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix fiemap wild read on empty truncated response\n\nsmb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob\nand loops for the next chunk. If the server reports\nSTATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns\n-E2BIG with out_data == NULL and out_data_len == 0, and the existing\nlength checks accept the empty result. The loop then evaluates\n\n\tnext = out_data[num - 1].file_offset + ...\n\nwith num == 0, reading 16 bytes before NULL.\n\nReject a truncated range blob that contains no range, so the resume\noffset is never computed from an empty response. Also require the last\nrange in a truncated blob to advance the resume offset without\noverflowing, and to stay within the requested range; a malicious or\nbroken server could otherwise make no progress or underflow len and loop\nforever. Free the previous response buffer before retrying.\n\nReproduced on 6.6.87.2 with a malicious SMB2 server that answers\nFSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and\nOutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in\ncifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged\non mainline."}], "id": "CVE-2026-99274", "lastModified": "2026-11-10T19:22:31.327", "metrics": {}, "published": "2026-11-07T14:17:02.730", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4a426ca5be7e3dedbe76575b967db04fbf01136f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8e0d425b808c367f5033eb72aa4528ae18473627"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of service via empty truncated responses in SMB client", "id": "2568636", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568636"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's SMB client. When handling file extent mapping (fiemap) requests, the client improperly validates empty truncated responses from the server. A malicious SMB server can exploit this vulnerability by returning a specially crafted response, triggering an out-of-bounds memory read or an infinite loop. This failure can cause a system crash, leading to a denial of service (DoS)."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that CIFS/SMB shares are mounted only from trusted, verified file servers and restrict outbound SMB connections to authorized hosts.\nIf SMB client functionality is not required on the system, prevent the cifs kernel module from loading by running the following command as root:\n# echo \"install cifs /bin/true\" > /etc/modprobe.d/disable-cifs.conf\nIf the module is currently loaded and no SMB shares are mounted, unload it:\n# modprobe -r cifs\nCaveats:\nDisabling the cifs module prevents the system from mounting remote SMB/CIFS file shares. If the module is currently in use, all SMB mounts must be unmounted or a system reboot will be required for the change to take full effect."}, "name": "CVE-2026-99274", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-07T14:08:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99274\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99274\nhttps://git.kernel.org/stable/c/31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca\nhttps://git.kernel.org/stable/c/4a426ca5be7e3dedbe76575b967db04fbf01136f\nhttps://git.kernel.org/stable/c/f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc"], "statement": "This vulnerability is rated as Moderate because successful exploitation requires a client to mount an untrusted SMB server and issue file extent mapping queries against it, limiting the blast radius to a denial of service on the connecting system. While a malicious server can craft an invalid response to crash the kernel or trigger a hang, it cannot compromise system confidentiality or integrity directly. Typical Red Hat Enterprise Linux deployments only connect to trusted file servers within secure network perimeters, which significantly reduces practical exposure.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4,4a426ca5be7e3dedbe76575b967db04fbf01136f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4,31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4,f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.61,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4,4a426ca5be7e3dedbe76575b967db04fbf01136f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4,31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4,f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.61,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-07T16:00:17.571146+00:00", "updated": "2026-11-08T01:30:18.810870+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125", "CWE-126", "CWE-476"]}