Quick answers
- Is CVE-2026-99274 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-99274 being exploited in the wild.
- How severe is CVE-2026-99274?
- Informational severity, published 7 November 2026.
- Which products and versions are affected?
- Linux Kernel 6.6.87.2 and earlier versions with SMB client code.
- Is there a fix for CVE-2026-99274?
- A patch was published on 2026-10-23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-99274 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-99274?
- Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The smb3_fiemap() function in fs/smb/client/smb2ops.c fails to validate that a truncated range blob (indicated by -E2BIG from SMB2_ioctl()) contains at least one range before accessing the array. When the server reports STATUS_BUFFER_OVERFLOW with OutputCount == 0, the function attempts to compute the resume offset from out_data[num-1] with num == 0, reading 16 bytes before NULL (out_of-bounds read). The attack requires network access to provide a malicious SMB server response.
Affected products
- Linux Linux Kernel 6.6.87.2 and earlier versions with SMB client code
Timeline
- 2026-11-07: disclosed
- 2026-10-23: patched