SB2026110858 - Out-of-bounds read in Linux kernel smb client

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-99274)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service in the Linux kernel.

The vulnerability exists due to an out-of-bounds read in smb3_fiemap() when processing an empty, truncated allocated-range response from an SMB2 server. A remote attacker can return STATUS_BUFFER_OVERFLOW with OutputCount == 0 in response to FSCTL_QUERY_ALLOCATED_RANGES to trigger a read before a NULL response buffer and a kernel crash when an FS_IOC_FIEMAP ioctl is issued on the mounted share.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca
• https://git.kernel.org/stable/c/4a426ca5be7e3dedbe76575b967db04fbf01136f
• https://git.kernel.org/stable/c/f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc