{"id":"CVE-2026-99113","revision":"b3a2ccd7603443369c120276eecb673a","records":[{"revision":"b3a2ccd7603443369c120276eecb673a","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2026-99113","aliases":[],"title":"ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in\n\nsmb2_get_info_filesystem() reports 64 bytes for FS_OBJECT_ID_INFORMATION,\nthat is the whole of struct object_id_info, but writes only 46 of them:\n\n - objid[] is 16 bytes, and when the volume UUID is not available only\n   sizeof(stfs.f_fsid) (8) bytes are copied into it;\n - extended_info.version_string[] is STRING_LENGTH (28) bytes, and only\n   strlen(\"1.1.0\") (5) bytes are copied into it.\n\nThe response buffer is zeroed on allocation (kvzalloc() in\nsmb2_allocate_rsp_buf()), so for a standalone request the remaining 31\nbytes are zero.  In a compound request they need not be.  The offset of\nthe next response is advanced by the length pinned for the previous one,\nso if a preceding command wrote its reply into the buffer and then\nfailed, smb2_set_err_rsp() pins only the short error response and the\nnext reply lands inside the area that has already been written.  Only\nthe header is cleared there:\n\n\tmemset((char *)rsp_hdr, 0, sizeof(struct smb2_hdr) + 2);\n\nThe client then receives up to 31 bytes of a response it was not meant\nto see, including one that failed with an access denied error.\n\nClear the structure before filling it in.  As a side effect\nversion_string is now NUL terminated.","state":0,"publishedAt":"2026-10-28T10:34:30.767+00:00","modifiedAt":"2026-10-30T12:41:51.384+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/server/smb2pdu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"dbd0f13de153d7094b85034daffa7533d7c2b17a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"90898571fb2c6813c007a62833dd65c00481d44e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"1a35a81c302b36fe4acd35b47b51d5d73e89ba0a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"3fc33ac2125b60f103592b83821f69f3f9aa23ba\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"898cb4f2e12a5ddea1b2d821cc642c3100f46da7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"015fffa48e96ca8d73a627445341ccff86b02251\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"399aa12450a61a5c73dc77e73f069ece9687c95d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/server/smb2pdu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.224\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.161\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.115\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/dbd0f13de153d7094b85034daffa7533d7c2b17a","https://git.kernel.org/stable/c/90898571fb2c6813c007a62833dd65c00481d44e","https://git.kernel.org/stable/c/1a35a81c302b36fe4acd35b47b51d5d73e89ba0a","https://git.kernel.org/stable/c/3fc33ac2125b60f103592b83821f69f3f9aa23ba","https://git.kernel.org/stable/c/898cb4f2e12a5ddea1b2d821cc642c3100f46da7","https://git.kernel.org/stable/c/015fffa48e96ca8d73a627445341ccff86b02251","https://git.kernel.org/stable/c/399aa12450a61a5c73dc77e73f069ece9687c95d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99113","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99113","identifiers":["CVE-2026-99113"]},"retained":false,"historicalAffected":[]}],"coverage":[]}