Is CVE-2026-99272 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-99272 being exploited in the wild.

How severe is CVE-2026-99272?

Informational severity, published 7 November 2026.

Which products and versions are affected?

Linux Kernel All versions with SMB2 client support.

Is there a fix for CVE-2026-99272?

Yes: fixed in Resolved by validation in SMB2_read() ensuring DataOffset and DataLength fit within response bounds (commit 2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1). Until then: Restrict SMB client access to trusted SMB servers only; disable SMB2 support if not required for business operations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-99272 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-99272?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-99272: Linux kernel SMB2 client buffer over-read in SMB2_read()

CVE-2026-99272 · Severity: info · Published 2026-11-07

The Linux kernel's SMB2 client implementation contains a buffer over-read vulnerability in the SMB2_read() function used for reading files from SMB servers. A malicious SMB server can craft a specially crafted READ response that causes the client to copy data beyond the bounds of the received buffer, potentially exposing sensitive kernel memory or causing a system crash.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-99272 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-99272 being exploited in the wild.
How severe is CVE-2026-99272?: Informational severity, published 7 November 2026.
Which products and versions are affected?: Linux Kernel All versions with SMB2 client support.
Is there a fix for CVE-2026-99272?: Yes: fixed in Resolved by validation in SMB2_read() ensuring DataOffset and DataLength fit within response bounds (commit 2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1). Until then: Restrict SMB client access to trusted SMB servers only; disable SMB2 support if not required for business operations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-99272 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-99272?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Resolved by validation in SMB2_read() ensuring DataOffset and DataLength fit within response bounds (commit 2ec9cdf469dd32bcf33073aeb30c08e9356e0ca1)

Restrict SMB client access to trusted SMB servers only; disable SMB2 support if not required for business operations.

Technical details

The SMB2_read() function fails to validate that the DataOffset and DataLength fields from the server response stay within the bounds of the actual response buffer (rsp_iov.iov_len). An attacker controlling an SMB server can send a READ response with DataOffset=0 and an inflated DataLength value, causing the client to attempt to copy data from addresses beyond the 448-byte receive buffer—up to 16 KiB in general cases. This results in a kernel heap buffer over-read (KASAN-detectable slab-out-of-bounds).

Affected products

Linux Linux kernel All versions with SMB2 client support

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.