Executive brief
ksmbd is a Linux kernel SMB server component used to enable file sharing and network communication. An unauthenticated attacker can send a malformed SMB transform packet that bypasses minimum size validation, causing the kernel to read memory beyond the allocated request buffer and leak sensitive data back to the client.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the ksmbd connection handler loop. The receive path validates minimum SMB2 PDU size only when ProtocolId is SMB2_PROTO_NUMBER, allowing packets with SMB2_TRANSFORM_PROTO_NUM to bypass validation even when transform handling is not negotiated. On SMB 2.1 connections, a short transform packet reaches init_smb2_rsp_hdr(), which interprets the truncated request as a full SMB2 header and reads beyond the allocated buffer. The copied header fields are then returned to the unauthenticated client. The fix adds explicit minimum size validation for both standard SMB2 requests (SMB2_MIN_SUPPORTED_PDU_SIZE) and transform requests (SMB2_TRANSFORM_MIN_SUPPORTED_PDU_SIZE = transform header + SMB2 header), rejecting truncated packets before work allocation.
Affected products
- Linux Linux kernel Multiple versions (patch backported to multiple stable branches)
Timeline
- 2026-08-12: disclosed: CVE-2026-68431 published
- 2026-08-09: other: Upstream commit authored by Namjae Jeon
- 2026-08-23: patched: Backported to stable trees by Greg Kroah-Hartman