CVE-2026-99109

A flaw was found in the Linux kernel's SMB client. This flaw allows a local, unprivileged user to cause a Denial of Service (DoS) or potentially escalate privileges. The CIFSSMBSetEA() function fails to verify that an extended attribute value fits within the allocated request buffer before copying the data. By setting a large extended attribute on a Server Message Block (SMB) mount, an attacker can trigger a heap out-of-bounds write and crash the system.

This vulnerability is rated as Important because an unprivileged local user with write access to an active legacy SMB share can corrupt kernel slab memory, potentially achieving local privilege escalation or crashing the host. Exploitation requires an active SMB 1.0 filesystem mount accessible to the attacker, whereas Red Hat Enterprise Linux configurations default to SMB 2.1 or newer protocol versions. Consequently, environments that do not mount remote shares using the deprecated CIFS protocol are not susceptible to this attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.