CVE-2026-99275: Linux kernel SMB client buffer over-read in SESSION_SETUP parsing

CVE-2026-99275 · Severity: info · Published 2026-11-07

The Linux kernel's SMB client implementation contains a flaw in how it processes SMB2 SESSION_SETUP responses during NTLM authentication. A malicious or compromised SMB server can send a crafted response that causes the client to read sensitive data from memory beyond the expected response buffer and leak that data back to the server. This could expose credentials or other sensitive information from systems connecting to untrusted networks.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-99275 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-99275 being exploited in the wild.
How severe is CVE-2026-99275?
Informational severity, published 7 November 2026.
Which products and versions are affected?
Linux Kernel All supported stable trees (reproduced on 6.6.87.2); affects all versions since CIFS SMB2 session setup support was added.
Is there a fix for CVE-2026-99275?
A patch was published on 2026-10-23. Until you apply it: Restrict SMB client connections to trusted servers only; avoid mounting SMB shares from untrusted or public networks until the kernel is patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-99275 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-99275?
Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict SMB client connections to trusted servers only; avoid mounting SMB shares from untrusted or public networks until the kernel is patched.

Technical details

The vulnerability exists in the SMB2 client response parsing code (smb2_check_message and decode_ntlmssp_challenge). The parser accepts abnormally short SESSION_SETUP responses with STATUS_MORE_PROCESSING_REQUIRED status and reads SecurityBufferLength and SecurityBufferOffset fields from stale data in the receive buffer reused from prior frames, rather than from the actual response. When this stale length value is large (up to ~64 KB), the NTLM challenge decoder copies memory beyond the received response and transmits it to the server in the NTLMv2 AUTHENTICATE message.

Affected products

  • Linux Linux kernel All supported stable trees (reproduced on 6.6.87.2); affects all versions since CIFS SMB2 session setup support was added

Timeline

  • 2026-11-07: disclosed
  • 2026-10-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.