In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_…
CVE-2026-99083 · GHSA-2j87-48p3-j5xw · EUVD-2026-108934 · published 23 Oct 2026
How serious is it
- Severity: high, CVSS score 8.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-99083?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 0 <7.2.12
- Linux Linux: patch: 7.2.12
- Linux Linux: 0 <6.18.58
- Linux Linux: 0 <6.12.114
- Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <59c6dcc5dd9dafe764ca0d40525933b2be69b059
- Linux Linux: patch: 6.6.160
- Linux Linux: patch: 7.3
- Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4722d06b2907585074252061b1024a696c1cfc23
- Linux Linux: patch: 6.12.114
- Linux Linux: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <23a0be6a84a38ac169eeab49017934e8e27c65f0
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
In krb5_authenticate(), out_len is calculated to determine available
headroom in response_buf for the incoming Kerberos AP-REP token. However,
when SMB2_SESSION_SETUP is processed as a non-first element of a compounded
SMB2 request, the calculation omits work->next_smb2_rsp_hdr_off.
This causes out_len to overstate remaining buffer headroom by
the cumulative size of prior responses in the compound chain. Consequently,
the length check in ksmbd_krb5_authenticate()
(*out_len <= resp->spnego_blob_len) passes erroneously, allowing memcpy()
to write the AP-REP blob past the end of response_buf into adjacent kernel
heap memory.
Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len,
ensuring it accurately reflects physical remaining buffer space.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/59c6dcc5dd9dafe764ca0d40525933b2be69b059
- git.kernel.org/stable/c/80af1bde97d5a85ad6f2c40ca894ccc8fa75a27a
- git.kernel.org/stable/c/517404e157395d0f8da125ca956c566895dfcd06
- git.kernel.org/stable/c/4722d06b2907585074252061b1024a696c1cfc23
- git.kernel.org/stable/c/23a0be6a84a38ac169eeab49017934e8e27c65f0
- nvd.nist.gov/vuln/detail/CVE-2026-99083
Merged from ENISA EUVD. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON