Linux Kernel ksmbd: Out-of-bounds write in SMB2 QUERY_INFO (CVE-2026-99273)

A heap-based out-of-bounds write exists in the Linux kernel SMB server (ksmbd) implementation, specifically within the get_file_stream_info() function. The flaw occurs because the buffer size allocation logic for SMB2 QUERY_INFO responses fails to account for the UTF-16 NUL terminator appended by smb_strtoUTF16(). An attacker can cause a two-byte memory overwrite by supplying a stream name of a precise length that fills the 448-byte small buffer exactly, forcing the terminator to be written beyond the allocated boundary. This vulnerability affects Linux kernel versions up to 7.3.x using CONFIG_SMB_SERVER. The fix is available in mainline commit a025c4991a7d8.

Attack Chain

1. Attacker establishes an SMB connection (anonymous/guest access is sufficient if enabled on the share).
2. Attacker issues a SMB2 TREE_CONNECT request to a ksmbd share.
3. Attacker uses SMB2 CREATE to open a file with specific user.DosStream xattr lengths.
4. Attacker issues a SMB2 QUERY_INFO request with the FileStreamInformation class.
5. The server invokes get_file_stream_info() to build the response.
6. The server performs an insufficient buffer check for the stream name conversion.
7. The smb_strtoUTF16() function writes a NUL terminator two bytes past the allocated heap buffer.

Impact

The vulnerability allows an unauthenticated attacker to perform a fixed two-byte write of 0x0000 to kernel memory. While the corruption is restricted to a small, attacker-groomed buffer, it enables potential kernel memory corruption or stability issues on the target host.

Recommendation

• Patch Linux kernel to at least commit a025c4991a7d8 or apply the vendor-provided fix for distributions tracking stable 6.6 or 6.12 kernels.
• Disable guest/anonymous access to SMB shares if not strictly required to limit the attack surface.
• If immediate patching is not possible, restrict access to the SMB service (TCP 445) to trusted network segments.