CVE-2026-99275

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99275", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-07T14:08:46.188Z", "dateUpdated": "2026-11-07T14:08:46.188Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-07T14:08:46.188Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject short SESSION_SETUP responses\n\nsmb2_check_message() accepts frames shorter than struct smb2_pdu when\nthe SMB2 status is non-zero, before the minimum-PDU check added by\nb4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP\nresponse is therefore accepted even though it cannot contain the\nSecurityBufferOffset and SecurityBufferLength fields.\n\nThe parser then reads those fields from stale bytes left in the reused\nreceive buffer by an earlier frame. With a long stale\nSecurityBufferLength, decode_ntlmssp_challenge() copies up to about\n64 KB from beyond the receive object and sends the data back to the\nserver in the NTLMv2 AUTHENTICATE target info.\n\nReject short MPR SESSION_SETUP responses before the short-error path,\nand validate SecurityBufferOffset + SecurityBufferLength against the\nreceived response length before decoding the challenge.\n\nThe ordering bypass is not new: the short-error early return predates\nb4694f269e66d, and the unvalidated SecurityBufferLength read predates\nthe 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable\ntrees are affected. Reproduced on 6.6.87.2; the path is unchanged on\nmainline."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2misc.c", "fs/smb/client/smb2pdu.c"], "versions": [{"version": "5478f9ba9a34d660eb3227dcd16314689c51f946", "lessThan": "df63e01933886153e40706483b9635b2456ad91f", "status": "affected", "versionType": "git"}, {"version": "5478f9ba9a34d660eb3227dcd16314689c51f946", "lessThan": "4d8930afa3446041358a7db33e7b23a0bb9459b5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2misc.c", "fs/smb/client/smb2pdu.c"], "versions": [{"version": "3.6", "status": "affected"}, {"version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/df63e01933886153e40706483b9635b2456ad91f"}, {"url": "https://git.kernel.org/stable/c/4d8930afa3446041358a7db33e7b23a0bb9459b5"}], "title": "smb: client: reject short SESSION_SETUP responses", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/smb2misc.c", "fs/smb/client/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "df63e01933886153e40706483b9635b2456ad91f", "status": "affected", "version": "5478f9ba9a34d660eb3227dcd16314689c51f946", "versionType": "git"}, {"lessThan": "4d8930afa3446041358a7db33e7b23a0bb9459b5", "status": "affected", "version": "5478f9ba9a34d660eb3227dcd16314689c51f946", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/smb2misc.c", "fs/smb/client/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.6"}, {"lessThan": "3.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject short SESSION_SETUP responses\n\nsmb2_check_message() accepts frames shorter than struct smb2_pdu when\nthe SMB2 status is non-zero, before the minimum-PDU check added by\nb4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP\nresponse is therefore accepted even though it cannot contain the\nSecurityBufferOffset and SecurityBufferLength fields.\n\nThe parser then reads those fields from stale bytes left in the reused\nreceive buffer by an earlier frame. With a long stale\nSecurityBufferLength, decode_ntlmssp_challenge() copies up to about\n64 KB from beyond the receive object and sends the data back to the\nserver in the NTLMv2 AUTHENTICATE target info.\n\nReject short MPR SESSION_SETUP responses before the short-error path,\nand validate SecurityBufferOffset + SecurityBufferLength against the\nreceived response length before decoding the challenge.\n\nThe ordering bypass is not new: the short-error early return predates\nb4694f269e66d, and the unvalidated SecurityBufferLength read predates\nthe 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable\ntrees are affected. Reproduced on 6.6.87.2; the path is unchanged on\nmainline."}], "id": "CVE-2026-99275", "lastModified": "2026-11-07T14:17:02.850", "metrics": {}, "published": "2026-11-07T14:17:02.850", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4d8930afa3446041358a7db33e7b23a0bb9459b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df63e01933886153e40706483b9635b2456ad91f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Information disclosure via crafted SMB session setup responses", "id": "2568619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568619"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's SMB (Server Message Block) client. A malicious SMB server can exploit this vulnerability to trigger an out-of-bounds memory read, leading to sensitive information disclosure. Due to missing packet length checks on truncated session setup responses, the client reads unvalidated buffer metadata and copies adjacent kernel memory into outgoing authentication traffic sent back to the server."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability on systems where mounting remote SMB/CIFS file shares is not required, prevent the CIFS kernel module from loading:\n1. Create a configuration file in `/etc/modprobe.d/` to disable autoloading:\n```\necho \"install cifs /bin/true\" > /etc/modprobe.d/disable-cifs.conf\n```\n2. If the module is currently loaded, ensure all active CIFS shares are unmounted before unloading the module:\n```\nmodprobe -r cifs\n```\nCaveats:\nDisabling or unloading the `cifs` module prevents the system from mounting SMB/CIFS network shares. Unmounting active shares may disrupt applications or users accessing files on those mounts. On systems where SMB client functionality is mandatory, ensure connections are strictly restricted to trusted file servers."}, "name": "CVE-2026-99275", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-07T14:08:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99275\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99275\nhttps://git.kernel.org/stable/c/4d8930afa3446041358a7db33e7b23a0bb9459b5\nhttps://git.kernel.org/stable/c/df63e01933886153e40706483b9635b2456ad91f"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires an affected client system to actively initiate a connection to a rogue or compromised SMB server. Under typical Red Hat Enterprise Linux deployments, the kernel CIFS client is not exposed to unsolicited inbound network traffic and only executes when explicitly mounting remote shares. While an attacker operating a malicious SMB server can trigger an out-of-bounds memory read and obtain up to 64 KB of kernel memory via crafted session setup responses during authentication, the flaw does not allow remote code execution or modification of system data.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5478f9ba9a34d660eb3227dcd16314689c51f946,df63e01933886153e40706483b9635b2456ad91f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5478f9ba9a34d660eb3227dcd16314689c51f946,4d8930afa3446041358a7db33e7b23a0bb9459b5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5478f9ba9a34d660eb3227dcd16314689c51f946,df63e01933886153e40706483b9635b2456ad91f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5478f9ba9a34d660eb3227dcd16314689c51f946,4d8930afa3446041358a7db33e7b23a0bb9459b5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-07T16:00:17.568085+00:00", "updated": "2026-11-08T01:30:18.810158+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125"]}