{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"06a751809ebd33e95b05bf733697318a17a4872b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"0e64f89563164719ceb1aa33f2a8bfd6391fa340","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a025c4991a7d83edc4dd339e3ea86d8ff6226eca","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6.18.61","status":"affected","version":"0","versionType":"semver"},{"lessThan":"7.3.2","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.61","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-99273","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reserve space for the UTF-16 terminator in stream info\n\nsmb_strtoUTF16() always writes a terminating zero UTF-16 unit after the\nconverted characters, but get_file_stream_info() budgets only\nsizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry\nand sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing\n\"::$DATA\" entry. When an entry exactly fills the 448-byte small response\nbuffer, the terminator is written two bytes past the allocation.\n\nReserve one extra UTF-16 unit in both budget checks. The terminator is\nnot part of the wire format, so the reported lengths are unchanged.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794060525585,"publishedAt":1794060525585,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/06a751809ebd33e95b05bf733697318a17a4872b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/0e64f89563164719ceb1aa33f2a8bfd6391fa340"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/a025c4991a7d83edc4dd339e3ea86d8ff6226eca"}],"remediation":[],"revision":"4be78aeedc2ffa5a25913dec45a15b241feca5eb042d679ca67d733718bc9fed","sources":[{"modifiedAt":1794060525585,"name":"CNA: Linux","retrievedAt":1794064151985,"url":"https://www.cve.org/CVERecord?id=CVE-2026-99273"}],"ssvc":null,"status":"published","title":"ksmbd: reserve space for the UTF-16 terminator in stream info","updatedAt":1794064151985}