CVE-2026-99083 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel's ksmbd module represents a critical heap-based buffer overflow within the Kerberos authentication routine. This flaw specifically affects the krb5_authenticate function, which is responsible for handling Kerberos AP-REP tokens during SMB2 session setup procedures. The root cause lies in an incorrect calculation of available headroom within the response buffer when processing compounded SMB2 requests. In standard network protocol implementations, compound requests allow multiple commands to be sent in a single packet, improving efficiency by reducing round-trip latency. However, this optimization introduces complexity in memory management, as each command in the chain must account for space allocated to previous responses within the same shared buffer structure.
The technical flaw occurs when SMB2_SESSION_SETUP is processed not as an isolated request but as a non-first element of a compounded SMB2 request sequence. In such scenarios, the kernel calculates out_len to determine how much free space remains in response_buf for writing the incoming Kerberos AP-REP token. The original implementation fails to subtract work->next_smb2_rsp_hdr_off from this calculation. This variable represents the offset and cumulative size of prior responses already present in the compound chain. By omitting this subtraction, out_len erroneously overstates the remaining buffer headroom by exactly the amount occupied by previous responses. Consequently, the subsequent length check that verifies whether (*out_len <= resp->spnego_blob_len) passes incorrectly because it compares against an inflated value rather than the true physical limit of the buffer.
This miscalculation leads directly to a heap out-of-bounds write vulnerability. When memcpy() is executed to copy the AP-REP blob into response_buf, it writes data past the allocated end of the buffer and into adjacent kernel heap memory. This type of memory corruption can have severe operational impacts on system stability and security integrity. An attacker who can trigger this code path through crafted SMB2 compound requests may achieve arbitrary write primitives in kernel space. Such capabilities typically allow for privilege escalation, denial of service via kernel panic or crash, or potentially remote code execution if the adjacent heap metadata is manipulated effectively to control function pointers or object structures during subsequent allocations and frees.
From a classification perspective, this vulnerability aligns with CWE-122: Heap-based Buffer Overflow, as it involves writing beyond the boundaries of a dynamically allocated buffer on the kernel heap. It also relates to CWE-787: Out-of-bounds Write, specifically in the context of compound protocol handling where state tracking is complex. In terms of attack vectors and techniques, this flaw can be exploited via MITRE ATT&CK technique T1059.004: Command and Scripting Interpreter if used for initial access or lateral movement within a network environment that supports SMB2, although the primary impact here is local privilege escalation following successful authentication attempts. The vulnerability highlights the risks associated with complex protocol parsing logic where buffer boundaries are not strictly enforced relative to cumulative offsets in multi-command packets.
Mitigation strategies primarily involve applying the upstream kernel patch provided by the Linux maintainers which corrects the arithmetic operation within krb5_authenticate(). Administrators running affected versions of the ksmbd module must ensure their systems are updated with the fixed code that properly subtracts work->next_smb2_rsp_hdr_off when computing out_len. This ensures that the calculated remaining buffer space accurately reflects physical constraints, thereby preventing the erroneous length check and subsequent overflow. Additionally, organizations should enforce strict network segmentation policies to limit exposure of SMB services to untrusted networks and deploy intrusion detection systems capable of identifying anomalous patterns in compound SMB2 request sequences that might indicate exploitation attempts for this specific heap corruption flaw.