CVE-2026-99273 in Linux
Summary
by MITRE • 11/07/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: reserve space for the UTF-16 terminator in stream info
smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but get_file_stream_info() budgets only sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing "::$DATA" entry. When an entry exactly fills the 448-byte small response buffer, the terminator is written two bytes past the allocation.
Reserve one extra UTF-16 unit in both budget checks. The terminator is not part of the wire format, so the reported lengths are unchanged.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The vulnerability identified within the Linux kernel's ksmbd module represents a classic buffer overflow condition rooted in an off-by-one error during string conversion operations. Specifically, the flaw resides in how memory buffers are allocated and utilized when processing file stream information for SMB2 protocol responses. The function smb_strtoUTF16 is responsible for converting character strings into UTF-16 encoding, a standard requirement for network protocols like Server Message Block to ensure cross-platform compatibility. This conversion process inherently requires writing a terminating zero UTF-16 unit at the end of the converted string sequence to properly mark its conclusion in memory. However, the function get_file_stream_info, which constructs these response structures, fails to account for this mandatory terminator when calculating buffer sizes.
The technical flaw manifests during the budgeting phase where space is reserved for stream entries within a fixed-size small response buffer that has a capacity of 448 bytes. The existing logic allocates memory based on sizeof(struct smb2_file_stream_info) plus twice the length of the stream name, or specifically sized as sizeof(struct smb2_file_stream_info) plus fourteen bytes for the trailing "::DATA" entry. This calculation strictly covers the characters themselves but neglects the two-byte null terminator required by UTF-16 encoding standards. Consequently, when an input string is precisely long enough to fill the allocated 448-byte buffer with its content, the subsequent write operation of the terminating zero unit pushes data beyond the bounds of the allocated memory region. This results in a heap-based or stack-based buffer overflow depending on where the structure resides, potentially corrupting adjacent memory structures and leading to undefined behavior within the kernel space.
From an operational impact perspective, this vulnerability allows for potential remote code execution if triggered by a malicious client sending specially crafted SMB2 requests that exploit this boundary condition. An attacker could leverage the out-of-bounds write to overwrite critical kernel data structures, function pointers, or control flow mechanisms such as return addresses on the stack. This can lead to privilege escalation from an unauthenticated user context to root-level access, complete compromise of system integrity, and denial of service through kernel panic or crash. The severity is heightened by the fact that ksmbd handles network-facing SMB traffic, making it a direct attack surface for remote exploitation without requiring prior authentication in many configurations.
Mitigation strategies primarily involve applying the upstream patch provided by the Linux kernel maintainers which adjusts the memory allocation logic to reserve one additional UTF-16 unit in both budget checks performed within get_file_stream_info. This ensures that the terminating zero is written safely within the allocated bounds, preserving buffer integrity without altering the wire format or reported lengths since the terminator itself is not transmitted over the network. Administrators should ensure their systems are updated with the latest kernel versions containing this fix. Additionally, implementing strict input validation and length checks at the protocol parsing layer can provide defense-in-depth against similar off-by-one errors in other parts of the SMB implementation.
This vulnerability aligns with Common Weakness Enumeration CWE-120 Buffer Copy without Checking Size of Input which describes cases where data is copied into a buffer without verifying that it fits within the allocated space, and specifically relates to CWE-787 Out-of-bounds Write when considering the actual memory corruption effect. In terms of adversarial tactics, this flaw facilitates exploitation techniques categorized under ATT&CK T1059 Command and Scripting Interpreter or more broadly T1203 Exploitation for Client Execution if leveraged in a remote code execution scenario. The lack of bounds checking during string manipulation is a frequent source of critical vulnerabilities in network daemons, underscoring the importance of rigorous memory safety practices and automated static analysis tools that can detect such boundary condition failures before deployment.