Skip to main content

Linux kernel ksmbd CVE-2026-43185

| EUVDEUVD-2026-27748 CRITICAL
Uncontrolled Recursion (CWE-674)
2026-05-06 Linux GHSA-vcg7-gx5w-x44c
Buffer Overflow Linux Red Hat Suse
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
CRITICAL
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 08, 2026 - 13:34 vuln.today
CVSS changed
May 08, 2026 - 13:22 NVD
9.8 (CRITICAL)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix signededness bug in smb_direct_prepare_negotiation()

smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...). A maliciously provided preferred_send_size of 0x80000000 will return as smaller than max_recv_size, and then be used to set the maximum allowed alowed receive size for the next message.

By sending a second message with a large value (>1420 bytes) the attacker can then achieve a heap buffer overflow.

This fix replaces min_t(int, ...) with min_t(u32)

AnalysisAI

Heap buffer overflow in Linux kernel ksmbd SMB Direct negotiation allows remote unauthenticated attackers to achieve arbitrary code execution. The vulnerability stems from a signedness bug where a malicious SMB Direct client sends a crafted preferred_send_size value (0x80000000) that bypasses minimum size validation, then follows with an oversized message (>1420 bytes) triggering heap corruption. With CVSS 9.8 critical severity and network-accessible attack vector requiring no authentication, this represents a severe pre-auth remote code execution risk. EPSS score of 0.02% suggests limited observed exploitation activity. Vendor patches available across multiple stable kernel branches.

Technical ContextAI

The ksmbd module is Linux kernel's in-kernel SMB3 server implementation, providing native Windows file sharing support. The vulnerability exists in the SMB Direct (RDMA) code path within smb_direct_prepare_negotiation(), which handles SMB over RDMA transport negotiation. The function incorrectly casts unsigned 32-bit integers (u32) from network-controlled fields to signed integers before comparison using min_t(int, ...). In C, when 0x80000000 is interpreted as a signed 32-bit integer, it becomes -2147483648, causing it to pass minimum size validation. This signedness error (related to CWE-195 Signed to Unsigned Conversion Error and CWE-681 Incorrect Conversion between Numeric Types) allows an attacker to set an artificially small maximum receive size, then send a message exceeding allocated buffer bounds. The heap overflow occurs because subsequent message processing trusts the corrupted size value without re-validation. This affects the kernel's memory management subsystem directly, making it a critical pre-authentication attack surface.

RemediationAI

Apply vendor-supplied patches immediately for all systems running ksmbd with SMB Direct support. Fixed kernel versions include commits ceae058eb707ddd0d68f0872f9d9f23b7c30c37b, 55abc475d096da4a5356b6efb0cfdc6156bc1550, and 6b4f875aac344cdd52a1f34cc70ed2f874a65757 available in stable branches 6.18.16, 6.19.6, and 7.0. Update to latest stable kernel version for your distribution via standard package management. Patches available at https://git.kernel.org/stable/c/ceae058eb707ddd0d68f0872f9d9f23b7c30c37b and related commit URLs. For systems requiring SMB services but unable to patch immediately, disable ksmbd module entirely and migrate to userspace Samba server (rmmod ksmbd, blacklist ksmbd in modprobe configuration). If SMB Direct/RDMA features are not required, disable RDMA support in ksmbd configuration as compensating control, though this reduces performance for legitimate high-speed storage workloads. Restrict network access to SMB ports (445/TCP, 5445/TCP for ksmbd) to trusted networks only via firewall rules, recognizing this only mitigates internet-based attacks and does not protect against insider threats or lateral movement scenarios. Monitor kernel logs for ksmbd-related crashes or memory corruption indicators.

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2025-9624 HIGH POC
8.3
CVE-2021-28210 HIGH POC
7.8
CVE-2018-9918 HIGH POC
7.8
CVE-2025-57809 HIGH POC
7.7

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43185 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy