CVE-2026-99275: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99275 is a memory disclosure vulnerability in the Linux kernel's SMB client that allows a remote, attacker-controlled SMB server to leak approximately 64 KB of kernel memory back to itself. The flaw exists in the smb2_check_message() function, which incorrectly accepts short (64-byte) STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP responses that lack the required SecurityBufferOffset and SecurityBufferLength fields. All supported stable Linux kernel trees are affected, with the vulnerable code path confirmed on kernel 6.6.87.2 and unchanged on mainline; the issue traces back to at least the 2016 raw NTLMSSP split. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an out-of-bounds read (CWE-125) in the Linux kernel SMB2 client parser. When smb2_check_message() receives a non-zero SMB2 status, it takes an early return path that bypasses the minimum-PDU size check introduced by commit b4694f269e66d, allowing a 64-byte STATUS_MORE_PROCESSING_REQUIRED SESSION_SETUP response to be accepted even though it is too short to contain SecurityBufferOffset and SecurityBufferLength. The parser then reads these fields from stale bytes remaining in the reused receive buffer from a prior frame; if those stale bytes encode a large SecurityBufferLength, decode_ntlmssp_challenge() performs an out-of-bounds read of up to ~64 KB beyond the receive object boundary and includes that data in the NTLMv2 AUTHENTICATE target info sent back to the server. The fix requires rejecting short MPR SESSION_SETUP responses before the short-error path and validating SecurityBufferOffset + SecurityBufferLength against the actual received response length (GitHub Advisory, Red Hat Bugzilla).

A malicious or compromised SMB server can trigger this vulnerability to exfiltrate up to approximately 64 KB of kernel memory from a connecting Linux client per authentication attempt, with the leaked data transmitted back to the attacker in the NTLMv2 AUTHENTICATE message. The primary impact is a high confidentiality loss — leaked kernel memory may contain sensitive data such as cryptographic keys, credentials, or other in-memory secrets from the client system. Integrity and availability are not directly affected by this vulnerability (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date (GitHub Advisory). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability requires user interaction in the sense that a client must connect to an attacker-controlled SMB server, but no authentication or special privileges are required on the attacker's side. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Set up a malicious SMB server: The attacker deploys a custom SMB server (e.g., using a modified Impacket-based server or a custom implementation) capable of sending crafted SESSION_SETUP responses.
2. Lure the victim to connect: The attacker entices a Linux client running a vulnerable kernel to mount or connect to the attacker's SMB share (e.g., via a phishing link, network redirect, or man-in-the-middle on an unencrypted network path).
3. Send a short STATUS_MORE_PROCESSING_REQUIRED response: During the NTLMSSP authentication handshake, the server responds to the client's SESSION_SETUP request with a malformed 64-byte STATUS_MORE_PROCESSING_REQUIRED response that omits the SecurityBufferOffset and SecurityBufferLength fields.
4. Trigger stale buffer read: The Linux kernel SMB client, bypassing the minimum-PDU check, reads SecurityBufferOffset and SecurityBufferLength from stale bytes in the reused receive buffer. If those stale bytes encode a large length value, decode_ntlmssp_challenge() reads up to ~64 KB beyond the receive object boundary.
5. Receive leaked kernel memory: The client includes the out-of-bounds kernel memory in the NTLMv2 AUTHENTICATE target info and sends it back to the attacker's server, where the attacker captures and analyzes the leaked data for sensitive content (GitHub Advisory, Red Hat Bugzilla).

• Network: Outbound SMB (TCP 445) connections from Linux hosts to unexpected or external IP addresses; NTLMv2 AUTHENTICATE messages with unusually large target info blobs (approaching 64 KB) captured in network traffic.
• Logs: Kernel logs (dmesg) showing SMB client warnings or errors related to SESSION_SETUP response parsing; unexpected SMB mount activity in /var/log/syslog or journalctl to unfamiliar server addresses.
• Process: Unusual mount.cifs or smbclient processes connecting to external or untrusted hosts, particularly in environments where SMB connections to external servers are not expected.

Apply the upstream Linux kernel patches that reject short MPR SESSION_SETUP responses and validate SecurityBufferOffset + SecurityBufferLength against the received response length — fix commits are df63e01933886153e40706483b9635b2456ad91f and 4d8930afa3446041358a7db33e7b23a0bb9459b5 (GitHub Advisory). All supported stable kernel trees require patching; distributions such as Red Hat are tracking this via their security response process (Red Hat Bugzilla). As a workaround until patching is possible, avoid connecting Linux systems to untrusted or external SMB servers, and use firewall rules to restrict outbound SMB (TCP 445) connections to only known-trusted servers.