CVE-2026-99083: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99083 is a heap out-of-bounds write vulnerability in the Linux kernel's ksmbd (in-kernel SMB server) implementation, specifically within the krb5_authenticate() function. When an SMB2_SESSION_SETUP request carrying a Kerberos AP-REP token is processed as a non-first element of a compounded SMB2 request, the buffer headroom calculation (out_len) incorrectly omits work->next_smb2_rsp_hdr_off, causing a memcpy() to write past the end of response_buf into adjacent kernel heap memory. The vulnerability was published on October 23, 2026, and affects Linux kernel versions before 6.6.160, 6.12.114, 6.18.58, and 7.2.12. The CVSS base score is currently listed as 0.0 (pending full scoring), with Feedly estimating severity as Medium (GitHub Advisory, EUVD).

The root cause is an improper buffer size calculation (CWE-787: Out-of-bounds Write) in krb5_authenticate() within the ksmbd subsystem. When SMB2_SESSION_SETUP appears as a non-first command in a compounded SMB2 request chain, out_len is computed without subtracting work->next_smb2_rsp_hdr_off — the cumulative offset of prior responses already written into the shared response buffer. This causes the bounds check (*out_len <= resp->spnego_blob_len) to pass erroneously, after which memcpy() copies the Kerberos AP-REP blob beyond the allocated buffer boundary into adjacent kernel heap memory. The fix subtracts work->next_smb2_rsp_hdr_off from out_len to accurately reflect remaining physical buffer space (GitHub Advisory, Kernel Patch).

Successful exploitation allows an unauthenticated, network-adjacent attacker to corrupt adjacent kernel heap memory, potentially leading to arbitrary code execution with kernel privileges. This could result in full system compromise, including bypassing security boundaries, escalating privileges, accessing sensitive data, or causing a denial of service via kernel panic. Systems running ksmbd as an SMB server and configured to use Kerberos authentication are at risk (GitHub Advisory).

As of the disclosure date (October 23, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack is network-accessible and requires no authentication, but exploitation requires the target to have ksmbd enabled with Kerberos authentication configured, and the attacker must be able to send crafted compounded SMB2 requests (GitHub Advisory).

1. Reconnaissance: Identify Linux hosts with ksmbd (SMB server) enabled and accessible over the network (TCP port 445), using tools such as Nmap (nmap -p 445 --script smb2-security-mode) or Shodan.
2. Confirm Kerberos authentication: Probe the SMB2 server to confirm it supports Kerberos (SPNEGO/Kerberos negotiation) during session setup, as the vulnerability is only triggered in this authentication path.
3. Craft compounded SMB2 request: Construct a compounded SMB2 request where SMB2_SESSION_SETUP (carrying a crafted Kerberos AP-REP token) is placed as a non-first element in the compound chain, so that work->next_smb2_rsp_hdr_off is non-zero.
4. Trigger out-of-bounds write: Send the crafted compounded request to the target. The miscalculated out_len causes the bounds check to pass, and memcpy() writes the oversized AP-REP blob past the end of response_buf into adjacent kernel heap memory.
5. Achieve kernel heap corruption: Leverage the heap corruption to overwrite kernel objects (e.g., function pointers, security credentials) to escalate privileges or execute arbitrary code with kernel-level access (GitHub Advisory).

• Network: Unexpected or malformed SMB2 compound requests on TCP port 445 containing SESSION_SETUP commands as non-first elements with oversized SPNEGO/Kerberos blobs; connections from unknown or untrusted hosts to the SMB server.
• Logs: Kernel crash logs (dmesg, /var/log/kern.log) showing heap corruption errors, kernel panics, or KASAN/SLUB allocator warnings related to ksmbd or SMB2 session handling; unusual authentication failures or Kerberos errors in system logs.
• Process: Unexpected child processes or privilege escalation events originating from the ksmbd kernel thread; anomalous kernel module loading following SMB2 session activity.
• File System: Unexpected new files, modified binaries, or rootkit artifacts following exploitation of the kernel heap corruption.

Update the Linux kernel to a patched version: 6.6.160, 6.12.114, 6.18.58, 7.2.12, or 7.3+. If immediate patching is not possible, restrict access to TCP port 445 using firewall rules to limit exposure to trusted networks only. If ksmbd is not required in your environment, disable or unload the ksmbd kernel module (modprobe -r ksmbd) as an additional mitigation (GitHub Advisory, Kernel Patch).