In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In… (CVE-2026-99083)

The vulnerability in the Linux kernel's ksmbd service involves an incorrect calculation of the available buffer space (out_len) in the krb5_authenticate() function during processing of SMB2_SESSION_SETUP requests that are part of a compounded SMB2 request. The calculation omits the offset of prior SMB2 response headers (work->next_smb2_rsp_hdr_off), causing out_len to overstate the remaining buffer space. As a result, the length check comparing out_len to the SPNEGO blob length passes incorrectly, leading to a heap out-of-bounds write when memcpy() copies the AP-REP blob past the end of the allocated response buffer into adjacent kernel heap memory. The fix subtracts the missing offset to ensure the length check accurately reflects the physical buffer space.

This vulnerability allows a heap out-of-bounds write in kernel memory, which can lead to memory corruption. Such corruption could potentially cause system instability, crashes, or escalation of privileges if exploited. However, no known exploits in the wild have been reported. The impact is limited to systems running the vulnerable Linux kernel with ksmbd enabled and processing compounded SMB2_SESSION_SETUP requests with Kerberos authentication.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the calculation of available buffer space in krb5_authenticate(). Users should apply the official kernel updates or patches that include this fix. Since no vendor advisory or patch links are provided in the input, check the Linux kernel mailing lists or vendor advisories for the specific patch and update instructions. Until patched, avoid processing compounded SMB2_SESSION_SETUP requests with Kerberos authentication if possible.