{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-99113","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.392Z","datePublished":"2026-10-28T10:34:30.767Z","dateUpdated":"2026-10-30T12:41:51.384Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-30T12:41:51.384Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in\n\nsmb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION,\nthat is the whole of struct object_id_info, but writes only 46 of them:\n\n - objid[] is 16 bytes, and when the volume UUID is not available only\n   sizeof(stfs.f_fsid) (8) bytes are copied into it;\n - extended_info.version_string[] is STRING_LENGTH (28) bytes, and only\n   strlen(\"1.1.0\") (5) bytes are copied into it.\n\nThe response buffer is zeroed on allocation (kvzalloc() in\nsmb2_allocate_rsp_buf()), so for a standalone request the remaining 31\nbytes are zero.  In a compound request they need not be.  The offset of\nthe next response is advanced by the length pinned for the previous one,\nso if a preceding command wrote its reply into the buffer and then\nfailed, smb2_set_err_rsp() pins only the short error response and the\nnext reply lands inside the area that has already been written.  Only\nthe header is cleared there:\n\n\tmemset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);\n\nThe client then receives up to 31 bytes of a response it was not meant\nto see, including one that failed with an access denied error.\n\nClear the structure before filling it in.  As a side effect\nversion_string is now NUL terminated."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"],"versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"dbd0f13de153d7094b85034daffa7533d7c2b17a","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"90898571fb2c6813c007a62833dd65c00481d44e","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"1a35a81c302b36fe4acd35b47b51d5d73e89ba0a","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"3fc33ac2125b60f103592b83821f69f3f9aa23ba","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"898cb4f2e12a5ddea1b2d821cc642c3100f46da7","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"015fffa48e96ca8d73a627445341ccff86b02251","status":"affected","versionType":"git"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"399aa12450a61a5c73dc77e73f069ece9687c95d","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/smb2pdu.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"5.15.224","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.59","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.13","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.115"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.59"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/dbd0f13de153d7094b85034daffa7533d7c2b17a"},{"url":"https://git.kernel.org/stable/c/90898571fb2c6813c007a62833dd65c00481d44e"},{"url":"https://git.kernel.org/stable/c/1a35a81c302b36fe4acd35b47b51d5d73e89ba0a"},{"url":"https://git.kernel.org/stable/c/3fc33ac2125b60f103592b83821f69f3f9aa23ba"},{"url":"https://git.kernel.org/stable/c/898cb4f2e12a5ddea1b2d821cc642c3100f46da7"},{"url":"https://git.kernel.org/stable/c/015fffa48e96ca8d73a627445341ccff86b02251"},{"url":"https://git.kernel.org/stable/c/399aa12450a61a5c73dc77e73f069ece9687c95d"}],"title":"ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in","x_generator":{"engine":"bippy-1.2.0"}}}}