CVE-2026-99272— smb: client: validate the data area in SMB2_read()

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： smb: client: 在 SMB2_read() 中验证数据区域 SMB2_read() 函数在未检查读取范围是否位于实际接收到的响应包内的情况下，直接复制了字节的数据，源地址为。当 READ 响应中的为 0 时，会将数据长度置零，导致接受长度仅等于固定响应头部的帧；然而，仍会使用服务器提供的，该长度仅受和调用方指定长度的限制。恶意服务器可以利用 mfsymlinks（或 SFU）符号链接解析器所使用的同步读取操作，返回一个长度为 81 字节的 R

AI Predicted 8.8 Difficulty: Moderate Updated Nov 07, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Updated Nov 07, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

smb: client: validate the data area in SMB2_read()

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2_read() SMB2_read() copies le32_to_cpu(rsp->DataLength) bytes from (char *)rsp + rsp->DataOffset without checking that the range lies within the response actually received. A READ response with DataOffset == 0 makes smb2_get_data_area_len() zero the data length, so smb2_check_message() accepts a frame as short as the fixed response, while SMB2_read() still uses the server-supplied DataLength, capped only by CIFS_MAX_MSGSIZE and the caller's length. A malicious server can answer the synchronous read used by the mfsymlinks (or SFU) symlink parser with an 81-byte READ response carrying DataOffset 0 and DataLength 1067, making the client copy 1067 bytes from a 448-byte receive object (KASAN slab-out-of-bounds; up to 16 KiB in the general case). Clamp a zero (or header-overlapping) DataOffset to read_rsp_size, as handle_read_data() does for the asynchronous path, and reject the response unless DataOffset + DataLength fits within rsp_iov.iov_len. The SMB1 helper was fixed the same way in 5be5bdda5863.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	d8e050398d23ef7c019c96200b80d73f4e5cec0c ~ 1ba1937de005e261a8858f45bfef5da7458df94c	-
Linux	Linux	3.7	-

II. Public POCs for CVE-2026-99272

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99272

请登录查看更多情报信息。

Other References for CVE-2026-99272 (2)

https://www.cve.org/CVERecord?id=CVE-2026-99272

Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total

CVE-2026-99282		net/sched: sch_teql: fix use-after-free on lower qdisc drop
CVE-2026-99281		tun: Require CAP_NET_ADMIN to attach to an ownerless device
CVE-2026-99277		ksmbd: hold a connection reference for each session channel
CVE-2026-99279		ksmbd: reclaim ended sessions on logoff and expiration
CVE-2026-99278		ksmbd: limit sessions on each connection
CVE-2026-99280		ksmbd: drain session procfs readers before dropping table references
CVE-2026-99276		ksmbd: defer connection scavenging while session locks are busy
CVE-2026-99275		smb: client: reject short SESSION_SETUP responses
CVE-2026-99273		ksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99274		smb: client: fix fiemap wild read on empty truncated response
CVE-2026-99271		ALSA: line6: Clear prev_fbuf on capture buffer release

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux