{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ksmbd-linux-kernel--7.3.x/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-99273"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ksmbd (Linux kernel \u003c= 7.3.x)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA heap-based out-of-bounds write exists in the Linux kernel SMB server (ksmbd) implementation, specifically within the \u003ccode\u003eget_file_stream_info()\u003c/code\u003e function. The flaw occurs because the buffer size allocation logic for \u003ccode\u003eSMB2 QUERY_INFO\u003c/code\u003e responses fails to account for the UTF-16 NUL terminator appended by \u003ccode\u003esmb_strtoUTF16()\u003c/code\u003e. An attacker can cause a two-byte memory overwrite by supplying a stream name of a precise length that fills the 448-byte small buffer exactly, forcing the terminator to be written beyond the allocated boundary. This vulnerability affects Linux kernel versions up to 7.3.x using \u003ccode\u003eCONFIG_SMB_SERVER\u003c/code\u003e. The fix is available in mainline commit \u003ccode\u003ea025c4991a7d8\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes an SMB connection (anonymous/guest access is sufficient if enabled on the share).\u003c/li\u003e\n\u003cli\u003eAttacker issues a \u003ccode\u003eSMB2 TREE_CONNECT\u003c/code\u003e request to a \u003ccode\u003eksmbd\u003c/code\u003e share.\u003c/li\u003e\n\u003cli\u003eAttacker uses \u003ccode\u003eSMB2 CREATE\u003c/code\u003e to open a file with specific \u003ccode\u003euser.DosStream\u003c/code\u003e xattr lengths.\u003c/li\u003e\n\u003cli\u003eAttacker issues a \u003ccode\u003eSMB2 QUERY_INFO\u003c/code\u003e request with the \u003ccode\u003eFileStreamInformation\u003c/code\u003e class.\u003c/li\u003e\n\u003cli\u003eThe server invokes \u003ccode\u003eget_file_stream_info()\u003c/code\u003e to build the response.\u003c/li\u003e\n\u003cli\u003eThe server performs an insufficient buffer check for the stream name conversion.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esmb_strtoUTF16()\u003c/code\u003e function writes a NUL terminator two bytes past the allocated heap buffer.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated attacker to perform a fixed two-byte write of \u003ccode\u003e0x0000\u003c/code\u003e to kernel memory. While the corruption is restricted to a small, attacker-groomed buffer, it enables potential kernel memory corruption or stability issues on the target host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Linux kernel to at least commit \u003ccode\u003ea025c4991a7d8\u003c/code\u003e or apply the vendor-provided fix for distributions tracking stable 6.6 or 6.12 kernels.\u003c/li\u003e\n\u003cli\u003eDisable guest/anonymous access to SMB shares if not strictly required to limit the attack surface.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, restrict access to the SMB service (TCP 445) to trusted network segments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T11:39:23Z","date_published":"2026-11-08T11:39:23Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ksmbd-oob-write/","summary":"An out-of-bounds heap write vulnerability in the Linux kernel ksmbd module allows an unauthenticated SMB client to corrupt kernel memory via malformed FileStreamInformation queries.","title":"Linux Kernel ksmbd: Out-of-bounds write in SMB2 QUERY_INFO (CVE-2026-99273)","url":"https://feed.craftedsignal.io/briefs/2026-11-ksmbd-oob-write/"}],"language":"en","title":"CraftedSignal Threat Feed - Ksmbd (Linux Kernel \u003c= 7.3.x)","version":"https://jsonfeed.org/version/1.1"}