{"id":"CVE-2026-99273","published":"2026-11-07T14:17:02.600","lastModified":"2026-11-10T19:22:31.220","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reserve space for the UTF-16 terminator in stream info\n\nsmb_strtoUTF16() always writes a terminating zero UTF-16 unit after the\nconverted characters, but get_file_stream_info() budgets only\nsizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry\nand sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing\n\"::$DATA\" entry. When an entry exactly fills the 448-byte small response\nbuffer, the terminator is written two bytes past the allocation.\n\nReserve one extra UTF-16 unit in both budget checks. The terminator is\nnot part of the wire format, so the reported lengths are unchanged.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/06a751809ebd33e95b05bf733697318a17a4872b","tags":[]},{"url":"https://git.kernel.org/stable/c/0e64f89563164719ceb1aa33f2a8bfd6391fa340","tags":[]},{"url":"https://git.kernel.org/stable/c/583ede545a14f275a959772b5e1e50fe3e14b861","tags":[]},{"url":"https://git.kernel.org/stable/c/a025c4991a7d83edc4dd339e3ea86d8ff6226eca","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}