{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99274", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-07T14:08:45.924Z", "dateUpdated": "2026-11-07T14:08:45.924Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-07T14:08:45.924Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix fiemap wild read on empty truncated response\n\nsmb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob\nand loops for the next chunk. If the server reports\nSTATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns\n-E2BIG with out_data == NULL and out_data_len == 0, and the existing\nlength checks accept the empty result. The loop then evaluates\n\n\tnext = out_data[num - 1].file_offset + ...\n\nwith num == 0, reading 16 bytes before NULL.\n\nReject a truncated range blob that contains no range, so the resume\noffset is never computed from an empty response. Also require the last\nrange in a truncated blob to advance the resume offset without\noverflowing, and to stay within the requested range; a malicious or\nbroken server could otherwise make no progress or underflow len and loop\nforever. Free the previous response buffer before retrying.\n\nReproduced on 6.6.87.2 with a malicious SMB2 server that answers\nFSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and\nOutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in\ncifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged\non mainline."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "lessThan": "4a426ca5be7e3dedbe76575b967db04fbf01136f", "status": "affected", "versionType": "git"}, {"version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "lessThan": "31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca", "status": "affected", "versionType": "git"}, {"version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4", "lessThan": "f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/smb2ops.c"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.61", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4a426ca5be7e3dedbe76575b967db04fbf01136f"}, {"url": "https://git.kernel.org/stable/c/31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca"}, {"url": "https://git.kernel.org/stable/c/f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc"}], "title": "smb: client: fix fiemap wild read on empty truncated response", "x_generator": {"engine": "bippy-1.2.0"}}}}