AZL-111209
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111209.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-111209
- Upstream
- Published
- 2026-10-28T11:17:30Z
- Modified
- 2026-10-29T14:16:53Z
- Summary
- CVE-2026-99114 affecting package kernel 6.6.157.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
smb2_get_info_filesystem() reports 48 bytes for FS_CONTROL_INFORMATION, that is the whole of struct smb2_fs_control_info, but never assigns FileSystemControlFlags. Those four bytes go to the client as they are found in the response buffer.
The buffer is zeroed on allocation, so a standalone request leaks nothing. A compound request can leak: the offset of the next response is advanced by the length pinned for the previous one, so a reply that was written into the buffer and then dropped in favour of the short error response of smb2_set_err_rsp() stays there, and the next reply is laid over it with only the header cleared.
ksmbd does not implement quota tracking, so report no control flags.
- References