CVE-2026-99114None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
0.2% → 0.2%
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, but never assigns FileSystemControlFlags. Those four bytes go to the client as they are found in the response buffer.
The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2_set_err_rsp() stays there, and the next reply is laid over it with only the header cleared.
ksmbd does not implement quota tracking, so report no control flags.
Linux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 995456b5e703e128904a6cbc8b3347eb3d04c72cLinux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < c78aea8984c84767e87f677477e4784deb8adfdeLinux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < e8b82184a1982894820a91a72ac9857ddd5dffbfLinux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 370459776468fc68c97008360108f381e3120953Linux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < d8c450ad0d08980b39b08d435efa921086c8b227Linux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < 03bb4338c3a7c3fc4decf699a35753f0891aab2aLinux >= e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 < c0cd3fc6824122014da2b3b0cb7ddeaa2946ec8eLinux 5.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses