CVE-2026-99274
smb: client: fix fiemap wild read on empty truncated response
What happened?
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix fiemap wild read on empty truncated response
smb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob and loops for the next chunk. If the server reports STATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns -E2BIG with out_data == NULL and out_data_len == 0, and the existing length checks accept the empty result. The loop then evaluates
next = out_data[num - 1].file_offset + ...
with num == 0, reading 16 bytes before NULL.
Reject a truncated range blob that contains no range, so the resume offset is never computed from an empty response. Also require the last range in a truncated blob to advance the resume offset without overflowing, and to stay within the requested range; a malicious or broken server could otherwise make no progress or underflow len and loop forever. Free the previous response buffer before retrying.
Reproduced on 6.6.87.2 with a malicious SMB2 server that answers FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and OutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in cifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged on mainline.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| LinuxLinux | affected: 2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4 to < 8e0d425b808c367f5033eb72aa4528ae18473627; affected: 2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4 to < 4a426ca5be7e3dedbe76575b967db04fbf01136f; affected: 2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4 to < 31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca; affected: 2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4 to < f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc | See vendor advisory |
| LinuxLinux | affected: 5.2; unaffected: 0 to < 5.2; unaffected: 6.12.117 to ≤ 6.12.*; unaffected: 6.18.61 to ≤ 6.18.*; unaffected: 7.3.2 to ≤ 7.3.*; unaffected: 7.4-rc1 to ≤ * | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.
Sources and remediation references
- https://www.cve.org/CVERecord?id=CVE-2026-99274
- https://git.kernel.org/stable/c/8e0d425b808c367f5033eb72aa4528ae18473627
- https://git.kernel.org/stable/c/4a426ca5be7e3dedbe76575b967db04fbf01136f
- https://git.kernel.org/stable/c/31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca
- https://git.kernel.org/stable/c/f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc