SECURITY ANNOUNCEMENT

CVE-2026-99083

23 October 2026

to write the AP-REP blob past the end of response_buf into adjacent kernel Fix this by subtracting work->next_smb2_rsp_hdr_off when computing out_len, ensuring it accurately reflects physical remaining buffer space.

Introduced

Unavailable in source

Fixed releases

6.12.11480af1bde97d5a85ad6f2c40ca894ccc8fa75a27a

6.18.58517404e157395d0f8da125ca956c566895dfcd06

6.6.16059c6dcc5dd9dafe764ca0d40525933b2be69b059

7.2.124722d06b2907585074252061b1024a696c1cfc23

7.323a0be6a84a38ac169eeab49017934e8e27c65f0

View source announcement ↗