{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "676392184785ace61e939831e7ca44a03d438c3b"
            },
            {
              "fixed": "a07dfb33112a42437f9d2d0bfd35c68575257381"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "ef572ffa8eb44111eed2925fbb2adca78bdcbf61"
            },
            {
              "fixed": "1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8"
            },
            {
              "fixed": "59c6dcc5dd9dafe764ca0d40525933b2be69b059"
            },
            {
              "fixed": "80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a"
            },
            {
              "fixed": "517404e157395d0f8da125ca956c566895dfcd06"
            },
            {
              "fixed": "4722d06b2907585074252061b1024a696c1cfc23"
            },
            {
              "fixed": "23a0be6a84a38ac169eeab49017934e8e27c65f0"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.15.145"
            },
            {
              "fixed": "5.15.224"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.1.40"
            },
            {
              "fixed": "6.1.191"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.4.5"
            },
            {
              "fixed": "6.5"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "2ba03cecb12ac7ac9e0170e251543c56832d9959"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.15.224"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.191"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.160"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.5.0"
            },
            {
              "fixed": "6.12.114"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.18.58"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "7.2.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99083.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix heap out-of-bounds write in krb5_authenticate()\n\nIn krb5_authenticate(), out_len is calculated to determine available\nheadroom in response_buf for the incoming Kerberos AP-REP token. However,\nwhen SMB2_SESSION_SETUP is processed as a non-first element of a compounded\nSMB2 request, the calculation omits work-\u003enext_smb2_rsp_hdr_off.\n\nThis causes out_len to overstate remaining buffer headroom by\nthe cumulative size of prior responses in the compound chain. Consequently,\nthe length check in ksmbd_krb5_authenticate()\n(*out_len \u003c= resp-\u003espnego_blob_len) passes erroneously, allowing memcpy()\nto write the AP-REP blob past the end of response_buf into adjacent kernel\nheap memory.\n\nFix this by subtracting work-\u003enext_smb2_rsp_hdr_off when computing out_len,\nensuring it accurately reflects physical remaining buffer space.",
  "id": "CVE-2026-99083",
  "modified": "2026-11-01T02:30:26.096588636Z",
  "published": "2026-10-23T12:45:01.735Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1f73a6d40f4d1bae4f3491c0ec1ea8ee6ce035ff"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a07dfb33112a42437f9d2d0bfd35c68575257381"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99083.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99083"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ksmbd: fix heap out-of-bounds write in krb5_authenticate()"
}