Executive brief
A vulnerability in the Linux kernel's SMB file-sharing server (ksmbd) could allow sensitive security keys to be recorded in system logs. If debug logging is enabled, the system inadvertently writes session and encryption keys to the logs in plain text. This could allow an attacker with access to system logs to intercept credentials and decrypt network traffic.
Technical details
An information disclosure vulnerability exists in the Linux kernel ksmbd (SMB server) module. When the KSMBD_DEBUG_AUTH logging level is enabled, the functions generate_smb3signingkey() and generate_smb3encryptionkey() write raw session, signing, encryption, and decryption key bytes to the kernel log. An attacker with local access to system logs (dmesg or syslog) could retrieve these keys to compromise SMB sessions. The issue has been resolved by removing the sensitive key material from the debug output. Patching is available via multiple stable kernel updates.
Affected products
- Linux Linux Kernel ksmbd component
Timeline
- 2026-03-03: other: Initial patch authored
- 2026-05-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/3fe2d9ec166b7df9a8df6c0fdcfc210572e27e3f
- https://git.kernel.org/stable/c/407cc37c21d51f9b9d4d20204b04890880cfa6ae
- https://git.kernel.org/stable/c/4084ed720d7d5f4e975c9e4a6267a552dad3b24a
- https://git.kernel.org/stable/c/441336115df26b966575de56daf7107ed474faed
- https://git.kernel.org/stable/c/c6b01b997a2094969e315f1ebfc1d64b8ae2163d
- https://git.kernel.org/stable/c/fec5c70b82af3f59f15bb984df94e5ad1fccfb1e