Executive brief
ksmbd is a kernel SMB/CIFS server implementation used to enable file sharing on Linux systems. A flaw in how it parses share configuration payloads could allow an attacker to read memory beyond buffer boundaries, potentially exposing sensitive kernel data or causing a denial of service.
Technical details
This is an out-of-bounds read vulnerability in the ksmbd IPC share configuration response parsing logic. The vulnerability occurs in the handling of variable-length veto list and share path fields within IPC messages. The root cause is insufficient validation of payload sizes before consuming these fields; string parsing functions like strlen() were used without length bounds, and the separator byte between fields was not properly accounted for. An attacker with access to send IPC messages to the ksmbd daemon (typically local or via a compromised user-space service) can craft malicious payloads that cause out-of-bounds memory reads. The fix involves using bounded string functions (strnlen, kstrndup), proper validation of payload size relationships, and explicit handling of field separators.
Affected products
- Linux Linux Kernel Multiple versions prior to patch commit f25e93768fcc5d8287e50b1ec52a42e4c276df34
Timeline
- 2026-09-16: disclosed: Published to NVD
- 2026-08-28: patched: Upstream commit f25e93768fcc5d8287e50b1ec52a42e4c276df34 authored by Namjae Jeon