Ksmbd (Linux Kernel <= 7.3.x) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ksmbd-linux-kernel--7.3.x/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 11:39:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLinux Kernel ksmbd: Out-of-bounds write in SMB2 QUERY_INFO (CVE-2026-99273)https://feed.craftedsignal.io/briefs/2026-11-ksmbd-oob-write/Sun, 08 Nov 2026 11:39:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ksmbd-oob-write/An out-of-bounds heap write vulnerability in the Linux kernel ksmbd module allows an unauthenticated SMB client to corrupt kernel memory via malformed FileStreamInformation queries.A heap-based out-of-bounds write exists in the Linux kernel SMB server (ksmbd) implementation, specifically within the get_file_stream_info() function. The flaw occurs because the buffer size allocation logic for SMB2 QUERY_INFO responses fails to account for the UTF-16 NUL terminator appended by smb_strtoUTF16(). An attacker can cause a two-byte memory overwrite by supplying a stream name of a precise length that fills the 448-byte small buffer exactly, forcing the terminator to be written beyond the allocated boundary. This vulnerability affects Linux kernel versions up to 7.3.x using CONFIG_SMB_SERVER. The fix is available in mainline commit a025c4991a7d8.

Attack Chain

  1. Attacker establishes an SMB connection (anonymous/guest access is sufficient if enabled on the share).
  2. Attacker issues a SMB2 TREE_CONNECT request to a ksmbd share.
  3. Attacker uses SMB2 CREATE to open a file with specific user.DosStream xattr lengths.
  4. Attacker issues a SMB2 QUERY_INFO request with the FileStreamInformation class.
  5. The server invokes get_file_stream_info() to build the response.
  6. The server performs an insufficient buffer check for the stream name conversion.
  7. The smb_strtoUTF16() function writes a NUL terminator two bytes past the allocated heap buffer.

Impact

The vulnerability allows an unauthenticated attacker to perform a fixed two-byte write of 0x0000 to kernel memory. While the corruption is restricted to a small, attacker-groomed buffer, it enables potential kernel memory corruption or stability issues on the target host.

Recommendation

  • Patch Linux kernel to at least commit a025c4991a7d8 or apply the vendor-provided fix for distributions tracking stable 6.6 or 6.12 kernels.
  • Disable guest/anonymous access to SMB shares if not strictly required to limit the attack surface.
  • If immediate patching is not possible, restrict access to the SMB service (TCP 445) to trusted network segments.
]]>highadvisory