Use of uninitialized resource in Linux kernel - CVE-2026-99113

Vulnerability details

The vulnerability allows a remote user to disclose portions of SMB responses that the client was not authorized to receive.

The vulnerability exists due to incomplete initialization of the FS_OBJECT_ID_INFORMATION response buffer in the Linux kernel ksmbd smb2_get_info_filesystem() function when handling compound SMB requests. A remote user can submit a compound request in which a preceding command writes response data before failing, causing the subsequent filesystem information response to overlap that data and disclose up to 31 bytes, including data from a response that failed with an access denied error.

Affected software

How to mitigate CVE-2026-99113

External References

• https://git.kernel.org/stable/c/015fffa48e96ca8d73a627445341ccff86b02251
• https://git.kernel.org/stable/c/399aa12450a61a5c73dc77e73f069ece9687c95d
• https://git.kernel.org/stable/c/898cb4f2e12a5ddea1b2d821cc642c3100f46da7

Related Security Bulletins

• Use of uninitialized resource in Linux kernel smb server