Executive brief
ksmbd is the Linux kernel's SMB2 file server implementation, used to share files with Windows clients and other SMB-capable systems. An authenticated SMB client can escape the configured file share boundaries and access arbitrary files on the system via a race condition during file creation, allowing unauthorized data access or modification.
Technical details
The vulnerability is a directory traversal flaw in the ksmbd subsystem's SMB2 file creation handler (ksmbd_vfs_kern_path_create). While SMB2 open operations enforce path boundary checks with LOOKUP_BENEATH, the file creation code paths for mkdir/create/hardlink operations incorrectly resolve absolute paths from the filesystem root rather than being anchored to the share mount point. An authenticated SMB client can race a missing path component: the open lookup returns -ENOENT (triggering the create branch), but when the create path walk executes, if the component now exists as a directory, the function will resolve ".." components from the real filesystem root, escaping the share. The fix roots the create path walk at the share boundary by using vfs_path_parent_lookup with LOOKUP_BENEATH and removing the vulnerable convert_to_unix_name function that built absolute paths. A patch is available and has been merged into the stable kernel branches.
Affected products
- Linux Linux kernel Versions before the fix (introduced in commit 265fd1991c1d and fixed in commit 1c8951963d8ed357f70f59e0ad4ddce2199d2016)
Timeline
- 2026-08-10: disclosed
- 2026-06-16: patched