CVE-2026-99275— smb: client: reject short SESSION_SETUP responses
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： smb: client: 拒绝过短的 SESSION_SETUP 响应 函数在 SMB2 状态码非零时，会接受长度小于 的数据帧，这一行为发生在由提交 引入的最小 PDU 检查之前。因此，一个长度为 64 字节的 类型的 SESSION_SETUP 响应会被接受，尽管该响应实际上无法包含 和 字段。 随后，解析器会从接收缓冲区中读取这些字段，而该缓冲区中残留的是之前某个数据帧留下的旧字节。如果残留的 值过大， 函数便会从接收对象之外复制多达约 64 KB 的数据，并将这
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-99275
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
smb: client: reject short SESSION_SETUP responses
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject short SESSION_SETUP responses
smb2_check_message() accepts frames shorter than struct smb2_pdu when
the SMB2 status is non-zero, before the minimum-PDU check added by
b4694f269e66d. A 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP
response is therefore accepted even though it cannot contain the
SecurityBufferOffset and SecurityBufferLength fields.
The parser then reads those fields from stale bytes left in the reused
receive buffer by an earlier frame. With a long stale
SecurityBufferLength, decode_ntlmssp_challenge() copies up to about
64 KB from beyond the receive object and sends the data back to the
server in the NTLMv2 AUTHENTICATE target info.
Reject short MPR SESSION_SETUP responses before the short-error path,
and validate SecurityBufferOffset + SecurityBufferLength against the
received response length before decoding the challenge.
The ordering bypass is not new: the short-error early return predates
b4694f269e66d, and the unvalidated SecurityBufferLength read predates
the 2016 raw NTLMSSP split in 166cea4dc3a4, so all supported stable
trees are affected. Reproduced on 6.6.87.2; the path is unchanged on
mainline.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-99275
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-99275
请登录查看更多情报信息。
Other References for CVE-2026-99275 (2)
Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total
| CVE-2026-99282 | net/sched: sch_teql: fix use-after-free on lower qdisc drop | |
| CVE-2026-99281 | tun: Require CAP_NET_ADMIN to attach to an ownerless device | |
| CVE-2026-99277 | ksmbd: hold a connection reference for each session channel | |
| CVE-2026-99279 | ksmbd: reclaim ended sessions on logoff and expiration | |
| CVE-2026-99278 | ksmbd: limit sessions on each connection | |
| CVE-2026-99280 | ksmbd: drain session procfs readers before dropping table references | |
| CVE-2026-99276 | ksmbd: defer connection scavenging while session locks are busy | |
| CVE-2026-99273 | ksmbd: reserve space for the UTF-16 terminator in stream info | |
| CVE-2026-99274 | smb: client: fix fiemap wild read on empty truncated response | |
| CVE-2026-99271 | ALSA: line6: Clear prev_fbuf on capture buffer release | |
| CVE-2026-99272 | smb: client: validate the data area in SMB2_read() |
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop -
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration -
CVE-2026-99278
ksmbd: limit sessions on each connection
Same vendor: Linux
-
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop -
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration -
CVE-2026-99278
ksmbd: limit sessions on each connection