CVE-2026-99274— smb: client: fix fiemap wild read on empty truncated response
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已被修复： smb: 客户端：修复空截断响应导致的 fiemap 越界读取问题 函数将来自 的 错误码视为范围数据被截断，并进入循环以获取下一块数据。然而，如果服务器返回 且 ，则 会返回 ，同时 且 。此时，现有的长度检查会错误地接受这个空结果。随后，循环会执行以下计算： 其中 ，导致在 指针之前读取了 16 个字节，引发越界读取。 修复方案： 1. 拒绝接收任何不包含有效范围的截断响应块，从而避免基于空响应计算恢复偏移量（resume offset）。 2. 要求截断响应块中的最
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-99274
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
smb: client: fix fiemap wild read on empty truncated response
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix fiemap wild read on empty truncated response
smb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob
and loops for the next chunk. If the server reports
STATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns
-E2BIG with out_data == NULL and out_data_len == 0, and the existing
length checks accept the empty result. The loop then evaluates
next = out_data[num - 1].file_offset + ...
with num == 0, reading 16 bytes before NULL.
Reject a truncated range blob that contains no range, so the resume
offset is never computed from an empty response. Also require the last
range in a truncated blob to advance the resume offset without
overflowing, and to stay within the requested range; a malicious or
broken server could otherwise make no progress or underflow len and loop
forever. Free the previous response buffer before retrying.
Reproduced on 6.6.87.2 with a malicious SMB2 server that answers
FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and
OutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in
cifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged
on mainline.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-99274
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-99274
请登录查看更多情报信息。
Other References for CVE-2026-99274 (3)
Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total
| CVE-2026-99282 | net/sched: sch_teql: fix use-after-free on lower qdisc drop | |
| CVE-2026-99281 | tun: Require CAP_NET_ADMIN to attach to an ownerless device | |
| CVE-2026-99277 | ksmbd: hold a connection reference for each session channel | |
| CVE-2026-99279 | ksmbd: reclaim ended sessions on logoff and expiration | |
| CVE-2026-99278 | ksmbd: limit sessions on each connection | |
| CVE-2026-99280 | ksmbd: drain session procfs readers before dropping table references | |
| CVE-2026-99276 | ksmbd: defer connection scavenging while session locks are busy | |
| CVE-2026-99275 | smb: client: reject short SESSION_SETUP responses | |
| CVE-2026-99273 | ksmbd: reserve space for the UTF-16 terminator in stream info | |
| CVE-2026-99271 | ALSA: line6: Clear prev_fbuf on capture buffer release | |
| CVE-2026-99272 | smb: client: validate the data area in SMB2_read() |
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop -
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration -
CVE-2026-99278
ksmbd: limit sessions on each connection
Same vendor: Linux
-
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop -
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration -
CVE-2026-99278
ksmbd: limit sessions on each connection