Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) allows an authenticated user to hijack file handles belonging to other users. By predicting or brute-forcing specific identifiers, an attacker can reconnect to a file that was previously opened by someone else, potentially leading to unauthorized access, modification, or deletion of sensitive data. This occurs because the server fails to verify if the person reconnecting to a file is the original owner.
Technical details
A vulnerability in ksmbd, the Linux kernel SMB server, stems from a failure to verify the SecurityContext during a durable handle reconnect request. According to the MS-SMB2 specification, the server must ensure the user attempting to reconnect to a durable handle is the same user who originally opened the file. Because ksmbd lacked this check, an authenticated attacker could hijack an orphaned durable handle by predicting or brute-forcing its persistent ID. The fix introduces a 'durable_owner' structure to store the original opener's UID, GID, and account name, and implements ksmbd_vfs_compare_durable_owner() to validate the requester's identity during SMB2_CREATE (DHnC) operations. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux kernel 6.6.32 to 6.7, 6.9 to 6.18.25, 6.19 to 7.0.2
Timeline
- 2026-05-01: disclosed
- 2026-05-01: advisory
- 2026-04-27: patched: Patch committed to stable tree.
References
- https://git.kernel.org/stable/c/00ce8d6789dae72d042a4522264964c72891ca37
- https://git.kernel.org/stable/c/49110a8ce654bbe56bef7c5e44cce31f4b102b8a
- https://git.kernel.org/stable/c/712cdf917e77a6444ce3836874829d770db20ee6
- https://git.kernel.org/stable/c/c7f0f0d01c88bdcb8b1694d7d321670013f7ed7d
- https://git.kernel.org/stable/c/c908c853f304a4969b5aa10eba0b50350cc65b80