---
id: CVE-2026-99273
title: 'ksmbd: reserve space for the UTF-16 terminator in stream info'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ksmbd: reserve space for the UTF-16 terminator in stream info

  smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the
  converted characters, but get_fil…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    06a751809ebd33e95b05bf733697318a17a4872b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    0e64f89563164719ceb1aa33f2a8bfd6391fa340
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a025c4991a7d83edc4dd339e3ea86d8ff6226eca
  - Linux < 6.18.61
  - Linux < 7.3.2
  - Linux (all versions)
published: '2026-11-07'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T14:08:45.585Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99273'
references:
  - url: 'https://git.kernel.org/stable/c/06a751809ebd33e95b05bf733697318a17a4872b'
  - url: 'https://git.kernel.org/stable/c/0e64f89563164719ceb1aa33f2a8bfd6391fa340'
  - url: 'https://git.kernel.org/stable/c/a025c4991a7d83edc4dd339e3ea86d8ff6226eca'
tags:
  - cve.org
ingestedAt: '2026-11-07T14:18:21.463Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: reserve space for the UTF-16 terminator in stream info

smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the
converted characters, but get_file_stream_info() budgets only
sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry
and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing
"::$DATA" entry. When an entry exactly fills the 448-byte small response
buffer, the terminator is written two bytes past the allocation.

Reserve one extra UTF-16 unit in both budget checks. The terminator is
not part of the wire format, so the reported lengths are unchanged.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 06a751809ebd33e95b05bf733697318a17a4872b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0e64f89563164719ceb1aa33f2a8bfd6391fa340`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a025c4991a7d83edc4dd339e3ea86d8ff6226eca`
- `Linux < 6.18.61`
- `Linux < 7.3.2`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.