{"id":"CVE-2026-99114","revision":"eb790b9f724e4b38857981225f5dc480","records":[{"revision":"eb790b9f724e4b38857981225f5dc480","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2026-99114","aliases":[],"title":"ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION\n\nsmb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION,\nthat is the whole of struct smb2_fs_control_info, but never assigns\nFileSystemControlFlags.  Those four bytes go to the client as they are\nfound in the response buffer.\n\nThe buffer is zeroed on allocation, so a standalone request leaks\nnothing.  A compound request can leak: the offset of the next response\nis advanced by the length pinned for the previous one, so a reply that\nwas written into the buffer and then dropped in favour of the short\nerror response of smb2_set_err_rsp() stays there, and the next reply is\nlaid over it with only the header cleared.\n\nksmbd does not implement quota tracking, so report no control flags.","state":0,"publishedAt":"2026-10-28T10:34:31.576+00:00","modifiedAt":"2026-10-30T12:41:52.446+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/server/smb2pdu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"995456b5e703e128904a6cbc8b3347eb3d04c72c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"c78aea8984c84767e87f677477e4784deb8adfde\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"e8b82184a1982894820a91a72ac9857ddd5dffbf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"370459776468fc68c97008360108f381e3120953\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"d8c450ad0d08980b39b08d435efa921086c8b227\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"03bb4338c3a7c3fc4decf699a35753f0891aab2a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\n                            \"lessThan\": \"c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/smb/server/smb2pdu.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.224\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.161\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.115\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/995456b5e703e128904a6cbc8b3347eb3d04c72c","https://git.kernel.org/stable/c/c78aea8984c84767e87f677477e4784deb8adfde","https://git.kernel.org/stable/c/e8b82184a1982894820a91a72ac9857ddd5dffbf","https://git.kernel.org/stable/c/370459776468fc68c97008360108f381e3120953","https://git.kernel.org/stable/c/d8c450ad0d08980b39b08d435efa921086c8b227","https://git.kernel.org/stable/c/03bb4338c3a7c3fc4decf699a35753f0891aab2a","https://git.kernel.org/stable/c/c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99114","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99114","identifiers":["CVE-2026-99114"]},"retained":false,"historicalAffected":[]}],"coverage":[]}