CRITICAL Introduced in 2.6.12
ksmbd StreamInfo Overflow
CVE-2026-99273
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but get_file_stream_info() budgets only sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing "::$DATA" entry. When an entry exactly fills the 448-byte small response buffer, the terminator is written two bytes past the allocation. Reserve one extra UTF-16 unit in both budget checks. The terminator is not part of the wire format, so the reported lengths are unchanged.
02KernelScan AI Analysis
Risk summary
A remote attacker who can connect to an exposed ksmbd (kernel SMB server) share can trigger a heap buffer overflow by requesting file stream information with a stream name length that exactly fills the response buffer. The overflow writes two null bytes past the allocation, corrupting adjacent kernel memory and potentially enabling remote code execution or kernel panic. Any system running ksmbd with network-accessible SMB shares is at risk.
Vulnerability analysis
The ksmbd server's get_file_stream_info() function calculates the space needed for each stream info entry but omits the two-byte UTF-16 null terminator that the string conversion routine always appends. When a stream name is crafted so that the entry exactly consumes the remaining space in the 448-byte response buffer, the terminator is written two bytes past the buffer boundary. The fix adds the missing terminator space to both budget checks, preventing the overflow. The vulnerability is reachable over the network by any authenticated SMB client — no local access or special privileges on the target host are required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 2.6.12 | 6.18.61 | 06a751809ebd |
| 7.3 | 2.6.12 | 7.3.2 | 0e64f8956316 |
| mainline | 2.6.12 | 7.4-rc1 | a025c4991a7d |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.114-cip34) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.190-cip62) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.272-cip79) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.272-cip79-rt35) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |