Executive brief
A vulnerability was identified in the Linux kernel's ksmbd component, which provides file-sharing services over a network. The flaw involves incorrect validation of data buffers when handling file attributes, which could allow an attacker to access sensitive information from the system's memory. This could lead to the exposure of private data or internal system details, potentially impacting the confidentiality of the server's operations.
Technical details
A vulnerability exists in the ksmbd component of the Linux kernel within the smb2_set_ea function. The issue stems from a buffer validation check that fails to account for the single-byte null terminator required for Extended Attribute (EA) names. By providing a specially crafted SMB2 request where the EaNameLength does not include the null terminator, an attacker could trigger an out-of-bounds read. This is a network-reachable vulnerability that does not require authentication or user interaction. The fix involves explicitly adding the missing byte to the validation logic to ensure the buffer size accurately reflects the expected data structure. Patches have been released for multiple stable kernel branches including 6.1.y and 6.6.y.
Affected products
- Linux Linux Kernel 6.1.52 to 6.1.160, 6.6 to 6.6.120, 5.15.131 to 5.16, 6.4.15 to 6.5, 6.5.2 to 6.6
Timeline
- 2025-12-14: patched: Initial patch authored by Namjae Jeon
- 2026-01-13: advisory: CVE published and advisory released
References
- https://git.kernel.org/stable/c/6dc8cf6e7998ef7aeb9383a4c2904ea5d22fa2e4
- https://git.kernel.org/stable/c/95d7a890e4b03e198836d49d699408fd1867cb55
- https://git.kernel.org/stable/c/a28a375a5439eb474e9f284509a407efb479c925
- https://git.kernel.org/stable/c/cae52c592a07e1d3fa3338a5f064a374a5f26750
- https://git.kernel.org/stable/c/d26af6d14da43ab92d07bc60437c62901dc522e6