CVE-2026-99115: ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fill in FileSysIdentifier in FSPOSIXINFORMATION

smb2getinfofilesystem() reports 56 bytes for FSPOSIXINFORMATION, that is the whole of FILESYSTEMPOSIXINFO, but never assigns FileSysIdentifier. Those eight bytes go to the client as they are found in the response buffer.

The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2seterrrsp() stays there, and the next reply is laid over it with only the header cleared.

Report the file system id statfs() returned, which is what the field is for. FileSysIdentifier is le64 and ffsid is a pair of ints, so assemble the value first, val[0] as the low half, and convert it on the way out.

Event History

Oct 28, 2026

CVE Published

via MITRE·10:34 AM

Data Sourced

via MITRE·10:34 AM

Description

Frequently Asked Questions

Under what circumstances can this disclose stale response-buffer data?

A standalone FS_POSIX_INFORMATION request does not leak data because the response buffer is zeroed when allocated. Disclosure requires a compound SMB request where an earlier reply was written, discarded in favor of a short smb2_set_err_rsp() error response, and a subsequent reply overlays that buffer with only its header cleared.

What must an attacker be able to do to trigger the issue?

The attacker needs to send crafted compound SMB requests to ksmbd that include a request for FS_POSIX_INFORMATION and induce the described earlier-response error condition. The exposed bytes are the uninitialized FileSysIdentifier field in the later filesystem-information response.

How can an administrator identify systems that need the fix?

Review whether the system uses the Linux kernel ksmbd SMB server and whether its kernel includes one of the referenced fixes. The provided information does not identify affected or fixed kernel version numbers.

CVE-2026-99115: ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION

Event History

Frequently Asked Questions

Under what circumstances can this disclose stale response-buffer data?

What must an attacker be able to do to trigger the issue?

How can an administrator identify systems that need the fix?

Company

Resources

Contact

Frequently Asked Questions

Under what circumstances can this disclose stale response-buffer data?

What must an attacker be able to do to trigger the issue?

How can an administrator identify systems that need the fix?