Strix
73.1K

CVE-2026-99083

HIGHCVSS 8.8/10EPSS 0.41%

Last modified

CVE-2026-99083 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. EPSS estimates a 0.41% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.41%

35.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 676392184785ace61e939831e7ca44a03d438c3b, < a07dfb33112a42437f9d2d0bfd35c68575257381; >= ef572ffa8eb44111eed2925fbb2adca78bdcbf61, < 1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff; >= 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8, < 59c6dcc5dd9dafe764ca0d40525933b2be69b059; >= 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8, < 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a; >= 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8, < 517404e157395d0f8da125ca956c566895dfcd06; >= 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8, < 4722d06b2907585074252061b1024a696c1cfc23; >= 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8, < 23a0be6a84a38ac169eeab49017934e8e27c65f0; 2ba03cecb12ac7ac9e0170e251543c56832d9959; >= 5.15.145, < 5.15.224; >= 6.1.40, < 6.1.191; >= 6.4.5, < 6.5
LinuxLinux6.5

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99083?
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
How severe is CVE-2026-99083?
CVE-2026-99083 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.41% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99083?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99083?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST