SB2026110859 - Out-of-bounds read in Linux kernel smb client

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-99275)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information from Linux kernel memory.

The vulnerability exists due to an out-of-bounds read in the Linux kernel SMB client's session setup handling when processing truncated SMB2 authentication responses. A remote attacker can send a crafted 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP response from a malicious SMB server, causing security buffer fields to be read from stale receive-buffer contents and potentially causing up to about 64 KB of memory beyond the receive object to be returned to the server in NTLMv2 AUTHENTICATE target information.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4d8930afa3446041358a7db33e7b23a0bb9459b5
• https://git.kernel.org/stable/c/df63e01933886153e40706483b9635b2456ad91f