Executive brief
A vulnerability has been identified in the Linux kernel's ksmbd component, which provides SMB file sharing services. An attacker could exploit integer overflow flaws to bypass security checks, potentially leading to unauthorized memory access or system instability. This could allow a local user to crash the system or view sensitive information that should be protected.
Technical details
A vulnerability exists in the ksmbd component of the Linux kernel due to insufficient validation of response sizes in ipc_validate_msg(). The function computes message sizes using attacker-controlled fields (payload_sz and ngroups) without overflow checks, allowing for integer wrapping. Specifically, KSMBD_EVENT_RPC_REQUEST, KSMBD_EVENT_SHARE_CONFIG_REQUEST, and KSMBD_EVENT_LOGIN_REQUEST_EXT are affected. When an overflow occurs, the resulting small size bypasses subsequent length checks, leading to out-of-bounds reads or writes in downstream functions like memcpy and kmemdup. The fix introduces check_add_overflow() and explicit range validation for group counts.
Affected products
- Linux Linux Kernel 5.15 to 6.12.84, 6.13 to 6.18.25, 6.19 to 7.0.2
Timeline
- 2026-05-01: disclosed
- 2026-05-01: advisory