Skip to main content

Linux kernel ksmbd CVE-2025-68806

HIGH
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

Network-reachable low-complexity OOB read leaking kernel memory, but exercising smb2_set_ea() needs an authenticated SMB session so PR:L; confidentiality-only, no integrity/availability impact per the description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
6.6 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 07:12 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:10 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.5 (HIGH)
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix buffer validation by including null terminator size in EA length

The smb2_set_ea function, which handles Extended Attributes (EA), was performing buffer validation checks that incorrectly omitted the size of the null terminating character (+1 byte) for EA Name. This patch fixes the issue by explicitly adding '+ 1' to EaNameLength where the null terminator is expected to be present in the buffer, ensuring the validation accurately reflects the total required buffer size.

AnalysisAI

Out-of-bounds buffer handling in the Linux kernel's ksmbd (in-kernel SMB3 server) Extended Attribute code allows a remote attacker to disclose adjacent kernel memory by sending a crafted SMB2 SET_INFO request. The smb2_set_ea() function validated the request buffer without accounting for the null-terminator byte of the EA name, so the size check under-counted the required length and permitted reads past the intended boundary. No public exploit is identified at time of analysis and EPSS probability is low (0.04%), but a vendor/upstream fix is available and it is not listed in CISA KEV.

Technical ContextAI

ksmbd is the Linux kernel's native SMB2/SMB3 file-server implementation (an in-kernel alternative to userspace Samba), reachable over TCP/445. The flaw lives in smb2_set_ea(), which processes FILE_FULL_EA_INFORMATION structures carrying Extended Attributes. Each EA entry declares an EaNameLength; the name is stored null-terminated, so the true consumed space is EaNameLength + 1. The validation logic omitted that trailing byte when checking the entry against the remaining buffer, allowing the parser to walk one byte (and, cumulatively across entries, further) beyond validated bounds. This is a classic off-by-one length-validation error (CWE-125 out-of-bounds read / CWE-193 off-by-one class); the CWE field was not populated by NVD in the source data.

Affected ProductsAI

The Linux kernel's ksmbd in-kernel SMB server component is affected. Exact vulnerable and fixed version ranges are not enumerated in the provided data, but the fix landed across multiple stable branches per the kernel.org stable commits (6dc8cf6e7998ef7aeb9383a4c2904ea5d22fa2e4, 95d7a890e4b03e198836d49d699408fd1867cb55, a28a375a5439eb474e9f284509a407efb479c925, cae52c592a07e1d3fa3338a5f064a374a5f26750, and d26af6d14da43ab92d07bc60437c62901dc522e6), indicating several maintained kernel lines were patched. Distribution-level exposure is confirmed for Ubuntu via advisory USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1), with an additional third-party writeup at VulDB (https://vuldb.com/?id.340647). No CPE strings were provided in the source data, so precise affected-version boundaries should be confirmed against each distributor's advisory.

RemediationAI

Apply the upstream fix available as stable kernel commits (see https://git.kernel.org/stable/c/95d7a890e4b03e198836d49d699408fd1867cb55 and the sibling commits) by upgrading to the patched kernel shipped by your distribution; Ubuntu users should install the kernel update from USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and reboot. Because an exact upstream tagged release version is not stated in the input, confirm the fixed package version against your distro's advisory before deployment. As a compensating control where patching must be delayed, disable the ksmbd service if it is not required (systemctl stop/disable ksmbd and unload the ksmbd kernel module), which fully removes the attack surface at the cost of losing in-kernel SMB serving; if ksmbd must stay online, restrict TCP/445 with host and network firewall rules to trusted management networks only, accepting that this breaks SMB access for any client not on the allowlist. There are no reliable in-kernel workarounds for the parsing flaw itself short of the patch.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-68806 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy