In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in…
CVE-2026-99113
In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in smb2getinfofilesystem() reports 64 bytes for FSOBJECTIDINFORMATION, that is the whole of struct objectidinfo, but writes only 46 of them: objid[] is 16 bytes, and when the volume UUID is not available only sizeof(stfs.ffsid) (8) bytes are copied into it; extendedinfo.versionstring[] is STRINGLENGTH (28) bytes, and only strlen("1.1.0") (5) bytes are copied into it. The response buffer is zeroed on allocation (kvzalloc() in smb2allocaterspbuf()), so for a standalone request the remaining 31 bytes are zero. In a compound request they need not be. The offset of the next response is advanced by the length pinned for the previous one, so if a preceding command wrote its reply into the buffer and then failed, smb2seterrrsp() pins only the short error response and the next reply lands inside the area that has already been written. Only the header is cleared there: memset((char )rsphdr, 0, sizeof(struct smb2hdr) + 2); The client then receives up to 31 bytes of a response it was not meant to see, including one that failed with an access denied error. Clear…
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 30 October 2026
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
At the source
References
- https://git.kernel.org/stable/c/015fffa48e96ca8d73a627445341ccff86b02251
- https://git.kernel.org/stable/c/1a35a81c302b36fe4acd35b47b51d5d73e89ba0a
- https://git.kernel.org/stable/c/399aa12450a61a5c73dc77e73f069ece9687c95d
- https://git.kernel.org/stable/c/3fc33ac2125b60f103592b83821f69f3f9aa23ba
- https://git.kernel.org/stable/c/898cb4f2e12a5ddea1b2d821cc642c3100f46da7
- https://git.kernel.org/stable/c/90898571fb2c6813c007a62833dd65c00481d44e
- https://git.kernel.org/stable/c/dbd0f13de153d7094b85034daffa7533d7c2b17a
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99113