Executive brief
The Linux kernel's ksmbd (SMB server) component has a memory safety flaw where it reads beyond allocated buffer boundaries when processing IPC responses from the userspace daemon. An attacker with local access and ability to interact with the ksmbd daemon could trigger a kernel crash or potentially execute code, affecting systems relying on ksmbd for file sharing services.
Technical details
The vulnerability is a heap buffer out-of-bounds read in ipc_validate_msg(), which validates IPC responses from the userspace ksmbd daemon. The function reads structure fields (payload_sz, session_key_len, ngroups, etc.) from the response buffer before verifying the buffer is large enough to contain those fields. The handle_response() function sizes the response buffer only from the netlink attribute length without proper validation, allowing the daemon to supply undersized responses (e.g., 8 bytes). When ipc_msg_send_request() calls ipc_validate_msg() for a KSMBD_EVENT_RPC_REQUEST, a cast to struct ksmbd_rpc_command reads resp->payload_sz at offset 8 of an 8-byte allocation, causing an out-of-bounds read detected by KASAN. The attack requires local access and ability to send crafted netlink messages to the ksmbd daemon. A fix involves validating the response buffer length before dereferencing its fields.
Affected products
- Linux Linux Kernel 7.2.0-rc3 and prior versions
Timeline
- 2026-09-17: disclosed