CVE-2026-99274

The Linux kernel contains a vulnerability in the SMB client where smb3_fiemap() performs a wild read when handling an empty truncated response from a server. Specifically, if an SMB2 server returns STATUS_BUFFER_OVERFLOW with OutputCount == 0, the SMB2_ioctl() function returns -E2BIG with a null ...

EUVD-2026-119288

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix fiemap wild read on empty truncated response smb3fiemap treats -E2BIG from SMB2ioctl as a truncated range blob and loops for the next chunk. If the server reports STATUSBUFFEROVERFLOW with OutputCount == 0,...