Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99273— ksmbd: reserve space for the UTF-16 terminator in stream info

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： ksmbd：在流信息中为 UTF-16 终止符预留空间 smb_strtoUTF16() 函数在转换后的字符之后总是写入一个零值的 UTF-16 终止单元。然而，get_file_stream_info() 函数仅为流条目预算了 sizeof(struct smb2_file_stream_info) + streamlen 2 字节，并为末尾的"::$DATA"条目预算了 sizeof(struct smb2_file_stream_info) + 7 2 字节。当某

AI Predicted 8.8 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99273

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ksmbd: reserve space for the UTF-16 terminator in stream info
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but get_file_stream_info() budgets only sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing "::$DATA" entry. When an entry exactly fills the 448-byte small response buffer, the terminator is written two bytes past the allocation. Reserve one extra UTF-16 unit in both budget checks. The terminator is not part of the wire format, so the reported lengths are unchanged.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ 06a751809ebd33e95b05bf733697318a17a4872b -
Linux Linux 6.18.61 ~ 6.18.* -

II. Public POCs for CVE-2026-99273

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99273

请登录查看更多情报信息。

Other References for CVE-2026-99273 (3)

Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total

CVE-2026-99282 net/sched: sch_teql: fix use-after-free on lower qdisc drop
CVE-2026-99281 tun: Require CAP_NET_ADMIN to attach to an ownerless device
CVE-2026-99277 ksmbd: hold a connection reference for each session channel
CVE-2026-99279 ksmbd: reclaim ended sessions on logoff and expiration
CVE-2026-99278 ksmbd: limit sessions on each connection
CVE-2026-99280 ksmbd: drain session procfs readers before dropping table references
CVE-2026-99276 ksmbd: defer connection scavenging while session locks are busy
CVE-2026-99275 smb: client: reject short SESSION_SETUP responses
CVE-2026-99274 smb: client: fix fiemap wild read on empty truncated response
CVE-2026-99271 ALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99272 smb: client: validate the data area in SMB2_read()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux