CVE-2026-99274: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99274 is a NULL pointer dereference (wild read) vulnerability in the Linux kernel's SMB3 client fiemap implementation. It affects the Linux kernel from version 5.2 onward, where smb3_fiemap() incorrectly handles an empty truncated response from an SMB2 server, leading to a kernel oops (denial of service). The vulnerability was published on November 7, 2026, with patches available in stable commits and kernel versions 6.18.61, 7.3.2, and 7.4-rc1. The CVSS base score is estimated as Medium (GitHub Advisory, Feedly).

The root cause is a NULL pointer dereference (CWE-476) in smb3_fiemap() within the Linux kernel's CIFS/SMB client. When an SMB2 server responds to FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and OutputCount == 0, SMB2_ioctl() returns -E2BIG with out_data == NULL and out_data_len == 0. The existing length checks incorrectly accept this empty result, and the loop then evaluates next = out_data[num - 1].file_offset + ... with num == 0, causing a read of 16 bytes before the NULL pointer (CR2 = fffffffffffffff8). Additionally, a malicious server could cause an infinite loop by never advancing the resume offset or by underflowing len. The fix rejects empty truncated range blobs, enforces resume offset advancement, and frees the previous response buffer before retrying (GitHub Advisory).

Successful exploitation causes a kernel oops (crash) in cifs_fiemap(), resulting in a denial of service on the affected Linux system. A local user with the ability to mount an SMB filesystem and issue FS_IOC_FIEMAP ioctls can trigger this by connecting to a malicious or compromised SMB2 server. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The attack requires local access to mount an SMB filesystem and the ability to direct the client to a malicious SMB2 server, limiting the attack surface. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly, GitHub Advisory).

1. Set up a malicious SMB2 server: Configure a rogue SMB2 server that responds to FSCTL_QUERY_ALLOCATED_RANGES requests with STATUS_BUFFER_OVERFLOW and OutputCount == 0, causing SMB2_ioctl() to return -E2BIG with out_data == NULL.
2. Induce victim to mount the malicious share: As a local user on the target Linux system (kernel 5.2–pre-patch), mount the attacker-controlled SMB share using standard mount commands (e.g., mount -t cifs //attacker-ip/share /mnt/target).
3. Trigger the fiemap ioctl: Execute an FS_IOC_FIEMAP ioctl on a file within the mounted share (e.g., via a custom tool or application that calls ioctl(fd, FS_IOC_FIEMAP, ...)). This causes smb3_fiemap() to process the empty truncated response.
4. Kernel oops triggered: The kernel dereferences a NULL pointer at out_data[num - 1] with num == 0, reading 16 bytes before NULL (CR2 = fffffffffffffff8), causing a kernel oops and system crash (GitHub Advisory, Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output referencing cifs_fiemap() or smb3_fiemap() with a fault address near fffffffffffffff8 (CR2 = fffffffffffffff8).
• Logs: System logs showing unexpected kernel panics or BUG traces involving the CIFS/SMB client subsystem after FS_IOC_FIEMAP ioctl calls.
• Network: SMB2 traffic where the server responds to FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and zero output data (OutputCount == 0), particularly from unexpected or untrusted server IPs.
• Process: Unusual processes or scripts invoking FS_IOC_FIEMAP ioctls on CIFS-mounted filesystems, especially from non-administrative users.

Upgrade the Linux kernel to a patched version: stable commits 4a426ca5be7e, 31f6dbb29fe1, or f5baa17a0f31 address the issue, with fixed releases at kernel 6.18.61, 7.3.2, and 7.4-rc1. Until patching is possible, restrict SMB mount operations to trusted servers only, and consider disabling SMB client functionality if not required. Implement network segmentation to prevent users from connecting to untrusted or attacker-controlled SMB servers (GitHub Advisory, Feedly).