Executive brief
A vulnerability exists in the Linux kernel's ksmbd component, which provides file-sharing services over a network. An attacker can exploit a flaw in how the system handles network negotiation messages to cause a system crash or potentially execute unauthorized commands. This could lead to a total loss of system availability and the exposure of sensitive data stored on the server.
Technical details
A signedness vulnerability exists in the smb_direct_prepare_negotiation() function within the ksmbd module of the Linux kernel. The function incorrectly casts unsigned 32-bit integers (max_recv_size and preferred_send_size) to signed integers before performing a comparison using min_t(int, ...). An attacker can provide a large value (e.g., 0x80000000) that is interpreted as a negative number, bypassing size constraints. This allows a subsequent message to trigger a heap buffer overflow. The issue is resolved by using min_t(u32) to ensure unsigned comparison.
Affected products
- Linux Linux Kernel 5.15 to 6.18.16, 6.19 to 6.19.6, 7.0-rc1
Timeline
- 2026-02-19: other: Vulnerability fixed in source code by author
- 2026-05-06: disclosed: CVE published
- 2026-05-06: advisory