{"id":"CVE-2026-99273","title":"ksmbd: reserve space for the UTF-16 terminator in stream info","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reserve space for the UTF-16 terminator in stream info\n\nsmb_strtoUTF16() always writes a terminating zero UTF-16 unit after the\nconverted characters, but get_fil…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 06a751809ebd33e95b05bf733697318a17a4872b","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0e64f89563164719ceb1aa33f2a8bfd6391fa340","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a025c4991a7d83edc4dd339e3ea86d8ff6226eca","Linux < 6.18.61","Linux < 7.3.2","Linux (all versions)"],"published":"2026-11-07","updated":"2026-11-07","sourceUpdated":"2026-11-07T14:08:45.585Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99273","references":[{"url":"https://git.kernel.org/stable/c/06a751809ebd33e95b05bf733697318a17a4872b"},{"url":"https://git.kernel.org/stable/c/0e64f89563164719ceb1aa33f2a8bfd6391fa340"},{"url":"https://git.kernel.org/stable/c/a025c4991a7d83edc4dd339e3ea86d8ff6226eca"}],"tags":["cve.org"],"ingestedAt":"2026-11-07T14:18:21.463Z","slug":"CVE-2026-99273","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reserve space for the UTF-16 terminator in stream info\n\nsmb_strtoUTF16() always writes a terminating zero UTF-16 unit after the\nconverted characters, but get_file_stream_info() budgets only\nsizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry\nand sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing\n\"::$DATA\" entry. When an entry exactly fills the 448-byte small response\nbuffer, the terminator is written two bytes past the allocation.\n\nReserve one extra UTF-16 unit in both budget checks. The terminator is\nnot part of the wire format, so the reported lengths are unchanged.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 06a751809ebd33e95b05bf733697318a17a4872b`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0e64f89563164719ceb1aa33f2a8bfd6391fa340`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a025c4991a7d83edc4dd339e3ea86d8ff6226eca`\n- `Linux < 6.18.61`\n- `Linux < 7.3.2`\n- `Linux (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}