UBUNTU-CVE-2026-99273: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smbstrtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but getfilestreaminfo() budgets only sizeof(struct smb2filestreaminfo) + streamlen 2 for a stream entry and sizeof(struct smb2filestreaminfo) + 7 2 for the trailing "::$DATA" entry. When an entry exactly fills the 448-byte small response buffer, the terminator is written two bytes past the allocation. Reserve one extra UTF-16 unit in both budget checks. The terminator is not part of the wire format, so the reported lengths are unchanged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In get_file_stream_info(), reserve one extra UTF-16 unit in both budget checks: allocate sizeof(struct smb2_file_stream_info) + (streamlen + 1) * 2 for stream entries and sizeof(struct smb2_file_stream_info) + (7 + 1) * 2 for the trailing "::$DATA" entry.