CVE-2026-99083

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix heap out-of-bounds write in krb5 authenticate()

In krb5 authenticate(), out len is calculated to determine available headroom in response buf for the incoming Kerberos AP-REP token. However, when SMB2 SESSION SETUP is processed as a non-first element of a compounded SMB2 request, the calculation omits work->next smb2 rsp hdr off.

This causes out len to overstate remaining buffer headroom by the cumulative size of prior responses in the compound chain. Consequently, the length check in ksmbd krb5 authenticate() (*out len <= resp->spnego blob len) passes erroneously, allowing memcpy() to write the AP-REP blob past the end of response buf into adjacent kernel heap memory.

Fix this by subtracting work->next smb2 rsp hdr off when computing out len, ensuring it accurately reflects physical remaining buffer space.