In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FSPOSIXINFORMATION…
CVE-2026-99115
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FSPOSIXINFORMATION smb2getinfofilesystem() reports 56 bytes for FSPOSIXINFORMATION, that is the whole of FILESYSTEMPOSIXINFO, but never assigns FileSysIdentifier. Those eight bytes go to the client as they are found in the response buffer. The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2seterrrsp() stays there, and the next reply is laid over it with only the header cleared. Report the file system id statfs() returned, which is what the field is for. FileSysIdentifier is le64 and ffsid is a pair of ints, so assemble the value first, val[0] as the low half, and convert it on the way out.
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 30 October 2026
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
At the source
References
- https://git.kernel.org/stable/c/1d644ab9eac767d52c9b8dc0eb68c0085994d9b6
- https://git.kernel.org/stable/c/ab057f271ef60ff8163818badc3de75c480eca07
- https://git.kernel.org/stable/c/beba2ef6f66a71f20531ac70a1acb0b221e362e9
- https://git.kernel.org/stable/c/cb9fbcaf1f3351bea771eec557fc6c4d2f35762b
- https://git.kernel.org/stable/c/da2ec27fdd7effbe4c94ec15b6c6a281800c5123
- https://git.kernel.org/stable/c/db2267b27c054a6c2151ff7fbb67927e784f31d6
- https://git.kernel.org/stable/c/f5c50f69a70fe22c44a50c869c8cd65fc35a0686
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99115