Linux kernel ksmbd: Heap out-of-bounds write in krb5_authenticate()
Summary
The in-kernel SMB file server ksmbd contains a flaw in the Kerberos session setup path. When SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculated buffer headroom is too large, so the AP-REP token can be written past the end of the response buffer into adjacent kernel heap memory. An authenticated remote attacker with low privileges could corrupt kernel memory, which may lead to a crash or code execution with kernel privileges. Systems without ksmbd enabled are not affected.
Affected
- Linux kernel with ksmbd enabled (affected ranges are inconsistent between sources; the exact earliest affected version is unknown)
- Stable branches listed as affected in the CVE record include 5.15.x before 5.15.224, 6.1.x before 6.1.191, and 6.6.x before 6.6.160 (per fix commits)
- Upstream: fixed in 5.15.224, 6.1.191, 6.6.160, 6.12.114, 6.18.58, 7.2.12 (per OSV)
Fixed in
- Linux kernel 5.15.224, 6.1.191, 6.6.160, 6.12.114, 6.18.58, 7.2.12 and later
- Upstream fix commits: 1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff, 23a0be6a84a38ac169eeab49017934e8e27c65f0, 4722d06b2907585074252061b1024a696c1cfc23, 517404e157395d0f8da125ca956c566895dfcd06, 59c6dcc5dd9dafe764ca0d40525933b2be69b059, 80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a, a07dfb33112a42437f9d2d0bfd35c68575257381
- Distribution kernel packages: Unknown.
Workaround
- No mitigation beyond the patch is documented by the sources.
- If ksmbd is not needed, unload or disable it.
- Keep TCP port 445 closed to untrusted networks.
Exploitation
- Not known to be exploited in the wild.
- No public exploit or proof of concept found.
- EPSS about 0.4% (Vulners).
Our recommendation
- Check whether ksmbd is loaded (for example with lsmod) or enabled in your kernel configuration.
- If ksmbd is not required, disable it.
- If ksmbd is required, apply the distribution kernel update as soon as it is available and reboot.
- Restrict SMB access (TCP 445) to trusted networks and close it to the internet.
- Monitor for unexpected kernel crashes and SMB session anomalies on file servers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 1f73a6d4 git.kernel.org
- Linux kernel stable commit 23a0be6a git.kernel.org
- Linux kernel stable commit 4722d06b git.kernel.org
- Linux kernel stable commit 517404e1 git.kernel.org
- OSV CVE-2026-99083 vulners.com
- Ubuntu CVE-2026-99083 ubuntu.com
- SUSE CVE-2026-99083 vulners.com
- VulDB 425808 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:43.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off. This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory. Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
NVD references (7)
- https://git.kernel.org/stable/c/1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff
- https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0
- https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23
- https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06
- https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059
- https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a
- https://git.kernel.org/stable/c/a07dfb33112a42437f9d2d0bfd35c68575257381
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.