# CVE-2026-99274: Linux kernel SMB client wild read in fiemap with empty truncated response

Source: https://junglewise.ai/threats/cve-2026-99274-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-99274 · Severity: info · Published 2026-11-07

The Linux kernel's SMB client implementation handles file extent mapping queries to SMB servers. When a malicious or misconfigured SMB server responds with a truncated empty response, the kernel reads 16 bytes before a null pointer, causing a kernel crash (oops). An attacker with control over an SMB server could crash the kernel of any client mounting the share, denying access to that mount.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-99274 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-99274 being exploited in the wild.

**How severe is CVE-2026-99274?** Informational severity, published 7 November 2026.

**Which products and versions are affected?** Linux Kernel 6.6.87.2 and earlier versions with SMB client code.

**Is there a fix for CVE-2026-99274?** A patch was published on 2026-10-23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-99274 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-99274?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The smb3_fiemap() function in fs/smb/client/smb2ops.c fails to validate that a truncated range blob (indicated by -E2BIG from SMB2_ioctl()) contains at least one range before accessing the array. When the server reports STATUS_BUFFER_OVERFLOW with OutputCount == 0, the function attempts to compute the resume offset from out_data[num-1] with num == 0, reading 16 bytes before NULL (out_of-bounds read). The attack requires network access to provide a malicious SMB server response.

## Affected products

- Linux Linux Kernel 6.6.87.2 and earlier versions with SMB client code

## Timeline

- 2026-11-07: disclosed
- 2026-10-23: patched

## References

- [https://git.kernel.org/stable/c/31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca](https://git.kernel.org/stable/c/31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca)
- [https://git.kernel.org/stable/c/4a426ca5be7e3dedbe76575b967db04fbf01136f](https://git.kernel.org/stable/c/4a426ca5be7e3dedbe76575b967db04fbf01136f)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)