EUVD-2026-108934
GHSA-2j87-48p3-j5xw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ksmbd SMB service
-
DeliverySend compounded SMB2 request with SESSION_SETUP non-first
-
ExploitBypass miscalculated out_len headroom check
-
ExecutionOverflow AP-REP blob into kernel heap
-
ImpactCorrupt adjacent kernel memory (DoS/RCE)
Vulnerability Assessment
| Exploitation Conditions | Requires the optional ksmbd in-kernel SMB3 server to be enabled and network-reachable, and Kerberos authentication to be configured so the krb5_authenticate() code path is exercised. The specific trigger stated in the source: SMB2_SESSION_SETUP must be processed as a non-first element of a compounded SMB2 request, so that work->next_smb2_rsp_hdr_off is non-zero and out_len overstates the remaining response_buf headroom, causing the ksmbd_krb5_authenticate() length check (*out_len <= resp->spnego_blob_len) to pass erroneously. Limiting factors: ksmbd is not enabled by default (most Linux file servers use userspace Samba, so the attack surface is narrow); the CVSS PR:L indicates authenticated access to the Kerberos session-setup path is needed; and the overflow only arises in the compound-chain code path, not for standalone session-setup requests. |
| Impact | Signals are mixed and point to a genuine but non-emergency priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity kernel heap out-of-bounds write with high confidentiality, integrity and availability impact - severe on paper. However, the EPSS score is very low (0.21%, 10th percentile), there is no CISA KEV listing (so no confirmed active exploitation), and no public exploit identified at time of analysis - only upstream patch commits are referenced, not proof-of-concept code. The vuln.today decision label is 'this_week', which aligns with a serious-but-not-active-exploitation posture: patch promptly, not an emergency. The most important moderating factor not captured by the CVSS score is that the vulnerable code path is ksmbd, the optional in-kernel SMB3 server, which is not enabled by default and is far less commonly deployed than userspace Samba; exploitation also requires the Kerberos authentication path and a compounded SMB2 request. Note the apparent tension: the base vector is AV:N/AC:L/PR:L yet the description makes clear the flaw is only reachable when ksmbd is enabled, Kerberos auth is in use, and SMB2_SESSION_SETUP appears as a non-first compound element - so the raw score overstates the realistic exposure of a typical Linux host. Net: credible kernel memory-corruption bug worth prompt patching on systems actually running ksmbd, but low likelihood of mass exploitation. |
| Exploit ScenarioDerived | An attacker who can reach an exposed ksmbd service with Kerberos authentication enabled sends a compounded SMB2 request in which SMB2_SESSION_SETUP is not the first element, making work->next_smb2_rsp_hdr_off non-zero. Because out_len omits that offset, the headroom check in ksmbd_krb5_authenticate() passes incorrectly and the AP-REP blob is memcpy'd past the end of response_buf into adjacent kernel heap memory, enabling heap corruption that can lead to denial of service or potentially kernel code execution. No public exploit identified at time of analysis; only the upstream fix commits are published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
A heap out-of-bounds write in the in-kernel SMB3 server ksmbd (ksmbd_krb5_authenticate()/krb5_authenticate()) lets an attacker with authenticated access to the Kerberos session-setup path write an attacker-influenced AP-REP blob past the end of response_buf into adjacent kernel heap memory. Only systems running the optional ksmbd module with Kerberos authentication configured and reachable over the network are exposed, and the overflow occurs specifically when SMB2_SESSION_SETUP arrives as a non-first element of a compounded SMB2 request, so standalone session-setup traffic does not trigger it. No public exploit code has been confirmed and the kernel fix is available; EPSS is low at 0.21% (10th percentile), but CNA scoring is high (CVSS 8.8, AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) and the kernel stable commits are published, making this a this-week remediation priority rather than an emergency.
RemediationAI
Update to a kernel carrying the fix for the branch in use: 6.6.160, 6.12.114, 6.18.58, 7.2.12 or the 7.3 line, applying the vendor stable commits (for example https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06 and https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059) via distribution kernel updates. Where an immediate kernel upgrade is not possible, reduce exposure by unloading and blacklisting the ksmbd module (modprobe -r ksmbd) or migrating the share to userspace Samba, at the cost of losing the in-kernel SMB3 service; alternatively, remove Kerberos authentication from the ksmbd share configuration so the krb5_authenticate() path is never exercised, understanding that this forces a different authentication mechanism and may break domain-joined clients; restricting TCP/445 to trusted management networks limits who can reach the service but does not fix the underlying flaw. Patch status: vendor-released patch is available per advisory, and the fix is prioritized for remediation this week under the vuln.today decision label.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ksmbd is the in-kernel SMB3 file server that is an alternative to userspace Samba. Within its SPNEGO/Kerberos authentication handling, krb5_authenticate() computes out_len as the headroom remaining in the per-request response_buf so that the incoming Kerberos AP-REP token from the client can be validated before it is copied out. When SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the response buffer already holds the responses of the earlier elements in the chain, and the headroom calculation fails to subtract work->next_smb2_rsp_hdr_off, which tracks the offset of the current response header within that chain. out_len therefore overstates the free space by the cumulative size of the preceding responses, the guard in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes even though the blob does not fit, and the subsequent memcpy() writes the AP-REP blob past response_buf into adjacent kernel heap memory. The root cause class is a heap-based out-of-bounds write driven by an incorrect length/offset calculation in compound request handling; no CWE identifier is supplied in the source data. The upstream fix subtracts work->next_smb2_rsp_hdr_off when computing out_len so the value reflects the physically remaining buffer space. Because the write happens in kernel context, successful corruption is scored as high confidentiality and integrity impact with scope unchanged, and the CVSS vector (PR:L) indicates the attacker must already be an authenticated user able to reach the Kerberos session-setup path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable ksmbd session setup requires Kerberos credentials (PR:L) with low complexity; kernel heap overwrite gives high C/I/A, scope unchanged within the kernel.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available headroom in response_buf for the incoming Kerberos AP-REP token. However, when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd_krb5_authenticate() (*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response_buf into adjacent kernel heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.
Executive ViewAI
CVE-2026-99083 is a high-severity heap out-of-bounds write in the Linux kernel's ksmbd SMB3 server, enabling authenticated attackers with network access to corrupt kernel memory during Kerberos session setup. Organizational impact is concentrated: only systems running the optional ksmbd module with Kerberos authentication and exposed SMB services are vulnerable, potentially leading to system compromise and lateral movement. Leadership should prioritize patching these specific servers within the week, as a fix is already available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB