Junglewise Threat Intelligence

CVE-2026-23220: Linux Kernel ksmbd infinite loop in SMB2 request handling

CVE-2026-23220 · Severity: medium · CVSS 5.5 · Published 2026-02-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's SMB file-sharing server (ksmbd) can cause the system to enter an infinite loop. This occurs when the server processes a specifically malformed or incorrectly signed request, leading to high CPU usage and a flood of error messages in the system logs. This can result in a denial-of-service condition, making the affected server unresponsive.

Technical details

A vulnerability exists in the ksmbd component of the Linux kernel due to an unreachable exit condition (CWE-835) in the request handling loop. When a signed SMB2 request fails signature verification in `__process_request()`, the `set_smb2_rsp_status()` function resets `work->next_smb2_rcv_hdr_off` to zero. This causes `is_chained_smb2_message()` to lose the pointer to the next command in a chained request, resulting in `__handle_ksmbd_work()` repeatedly processing the same failed request header if the `NextCommand` field is non-zero. An attacker with local access or the ability to send SMB requests can trigger this infinite loop, causing high CPU consumption and log flooding. The issue has been patched by changing the return value from `SERVER_HANDLER_CONTINUE` to `SERVER_HANDLER_ABORT` in error paths to ensure the loop terminates.

Affected products

  • Linux Linux Kernel 5.15.145 to 5.16; 6.1.71 to 6.1.164; 6.6.1 to 6.6.125; 6.7 to 6.12.72; 6.13 to 6.18.11; 6.19 to 6.19.1

Timeline

  • 2026-02-18: disclosed
  • 2026-02-18: advisory

References

Related threats