Executive brief
A vulnerability in the Linux kernel's SMB server (ksmbd) could allow users with write permissions to create files or folders outside of their assigned shared directory. This occurs because the server incorrectly handles certain file path requests when case-insensitive searching is enabled. An attacker could use this to bypass security boundaries and place files in unauthorized locations on the host system.
Technical details
A path traversal vulnerability exists in the ksmbd component of the Linux kernel due to improper error handling in the __ksmbd_vfs_kern_path() function. While ksmbd_vfs_path_lookup() correctly identifies path traversal attempts (using '..') and returns an -EXDEV error, the caseless retry logic fails to intercept this specific error. Instead, it treats -EXDEV as a generic file-not-found scenario and proceeds to reconstruct the path, effectively bypassing the LOOKUP_BENEATH restriction. This allows an authenticated user with write access to create zero-length files or directories outside the defined share boundary. The fix ensures that the caseless retry logic only triggers on -ENOENT errors.
Affected products
- Linux Linux Kernel versions before 7.1.4, 7.2-rc1
Timeline
- 2026-06-07: other: Patch authored
- 2026-07-25: disclosed: CVE published