Skip to main content

Linux ksmbd CVE-2026-68431

| EUVDEUVD-2026-57039 CRITICAL
2026-08-12 Linux GHSA-6pm5-g7cv-g948
Authentication Bypass Linux
Critical
Disputed · 9.1 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Reach ksmbd on TCP/445
  2. Delivery
    Negotiate SMB 2.1 dialect
  3. Exploit
    Send truncated SMB2_TRANSFORM_PROTO_NUM packet
  4. Install
    Bypass minimum PDU size check
  5. C2
    Parse runt buffer in init_smb2_rsp_hdr()
  6. Execute
    Read beyond request allocation
  7. Impact
    Return leaked kernel memory to client

Vulnerability Assessment

Exploitation Conditions

Exploitation requires the target to have the in-kernel ksmbd SMB server enabled and network-reachable on TCP/445, and the client must negotiate the SMB 2.1 dialect (a dialect that provides no transform handling); the attacker then sends a short packet whose ProtocolId is SMB2_TRANSFORM_PROTO_NUM so it bypasses the SMB2_MIN_SUPPORTED_PDU_SIZE check that only applied to SMB2_PROTO_NUMBER packets. No authentication or user interaction is needed (CVSS PR:N/UI:N, and leaked fields are returned to an unauthenticated client). The primary limiting factor is that ksmbd is an opt-in feature far less deployed than userspace Samba, so hosts without ksmbd enabled or without TCP/445 exposed to untrusted networks are not exploitable.
Impact

Signals are mostly aligned toward real, but bounded, risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/A:H) describes a pre-authentication, low-complexity network attack, and the description confirms the leaked data is returned to an unauthenticated client, supporting the confidentiality impact. The A:H component is not clearly substantiated by the text (an OOB read may crash the kernel but no DoS is described), so availability impact should be treated as inferred rather than confirmed. EPSS of 11% is moderately elevated for a kernel CVE but there is no CISA KEV entry and no POC referenced, so exploitation is plausible but not observed. The dominant limiting factor is exposure: ksmbd must be compiled, enabled, and network-reachable, and it is far less common than userspace Samba, which lowers real-world priority for most fleets. For hosts actually running ksmbd exposed to untrusted networks, this is a genuine patch-now item; for everyone else it is low practical risk.
Exploit ScenarioDerived

An attacker who can reach TCP/445 on a Linux host running ksmbd negotiates an SMB 2.1 session, then sends a deliberately truncated packet tagged as SMB2_TRANSFORM_PROTO_NUM. The runt packet bypasses the minimum-PDU-size check and is parsed as a full SMB2 header, causing ksmbd to read past the request allocation and return the out-of-bounds kernel bytes in its response, disclosing memory to the unauthenticated attacker. No public POC is referenced, and the attack requires only network access with low complexity.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 11.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 14, 2026

Out-of-bounds memory read in the Linux kernel's in-kernel SMB server (ksmbd) lets a remote, unauthenticated client leak adjacent kernel memory. The receive path applied the minimum SMB2 PDU size check only to packets with ProtocolId SMB2_PROTO_NUMBER, so a short packet carrying SMB2_TRANSFORM_PROTO_NUM slipped past validation on an SMB 2.1 connection (which offers no transform handling) and reached init_smb2_rsp_hdr(), which read past the request allocation and returned the copied fields to the client. Rated CVSS 9.1 with an EPSS of 11%; no public exploit or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.

RemediationAI

Update to a kernel that contains the fix commits b62c510f59803f82f9b4c76ead2a56833b2984c7 and cfc0b8e5080aec87700774e8568765eaa4b7b92b, which are backported across the affected stable branches (upgrade past 5.15.145/6.1.34/6.3.8 lines to the corresponding fixed stable release from your distribution; released tag numbers should be confirmed against your vendor's kernel package). Patch references are the kernel.org stable commits at https://git.kernel.org/stable/c/b62c510f59803f82f9b4c76ead2a56833b2984c7 and https://git.kernel.org/stable/c/cfc0b8e5080aec87700774e8568765eaa4b7b92b. Where immediate patching is not possible, the highest-value compensating control is to stop or unload the ksmbd server (disable the CONFIG_SMB_SERVER service or migrate SMB sharing to userspace Samba), which fully removes exposure at the cost of losing in-kernel SMB serving; if ksmbd must remain running, restrict TCP/445 with a host or network firewall to trusted management subnets only, accepting that legitimate SMB clients outside those subnets will lose access. Avoid negotiating down to SMB 2.1 where transform handling is absent, though firewalling the port is the more reliable mitigation.

Affected VersionsENISA

Linux e9cb7be2fcbaee9e808b729e92948d38d52e5add
Linux patch: 7.1.6
Linux 6.1.34 <6.2
Linux 6.3.8 <6.4
Linux patch: 0
Linux 368ba06881c395f1c9a7ba22203cf8d78b4addc0 <b62c510f59803f82f9b4c76ead2a56833b2984c7
Linux 5.15.145 <5.16
Linux 543c12c2644e772caa6880662c2a852cfdc5a10c
Linux patch: 7.2-rc5
Linux df3a4518aee64f21bcafa891105b468413f27431
Linux 6.4
Linux 368ba06881c395f1c9a7ba22203cf8d78b4addc0 <cfc0b8e5080aec87700774e8568765eaa4b7b92b

Affected Packages

euvd linux fix: 5.16, 6.2, 6.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ksmbd is the Linux kernel's native, in-kernel SMB3 file-server implementation (introduced in 5.15), an alternative to userspace Samba. SMB2/3 packets begin with a ProtocolId that is either SMB2_PROTO_NUMBER (a normal SMB2 header) or SMB2_TRANSFORM_PROTO_NUM (an encryption/compression transform header). The bug is an out-of-bounds read (CWE-125; CWE was N/A in the feed) caused by an incomplete length-validation predicate: the SMB2_MIN_SUPPORTED_PDU_SIZE floor was enforced for SMB2_PROTO_NUMBER packets but not for transform-tagged packets, even when the negotiated dialect (SMB 2.1) does not support transforms. init_smb2_rsp_hdr() then parses the runt buffer as a full SMB2 header and copies fields from beyond the allocation. The fix converts compression transforms to ordinary SMB2 messages before validation, then enforces SMB2_MIN_SUPPORTED_PDU_SIZE on ordinary requests and requires encryption transform requests to contain both a transform header and an SMB2 header, rejecting truncated packets before work allocation.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 8.2 HIGH

Pre-auth remote low-complexity OOB read leaks kernel memory to the client (C:H, PR:N); availability lowered to A:L since only a potential read-induced crash, not a described DoS, is supported.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 13, 2026 - 23:37 NVD
9.1 (CRITICAL)
Patch available
Aug 12, 2026 - 01:02 EUVD
CVE Published
Aug 12, 2026 - 00:07 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 12, 2026 - 00:07 cve.org
CRITICAL 9.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate minimum PDU size for transform requests

The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2_PROTO_NUMBER. A packet carrying SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated dialect does not provide transform handling.

On an SMB 2.1 connection, a short transform packet therefore reaches init_smb2_rsp_hdr(), which interprets the request as a full SMB2 header and reads beyond the request allocation. The copied fields can then be returned to the unauthenticated client.

Compression transforms are converted to ordinary SMB2 messages before protocol validation. After that conversion, validate ordinary SMB2 requests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption transform requests to contain both a transform header and an SMB2 header. This rejects truncated requests before work allocation.

Executive ViewAI

Why It Matters

CVE-2026-68431 is a critical memory disclosure vulnerability in the Linux kernel's SMB server (ksmbd) that allows unauthenticated remote attackers to leak sensitive kernel memory, potentially exposing system secrets and enabling follow-on attacks. Any organization running Linux systems with SMB services enabled should prioritize patching to prevent unauthorized data exfiltration and maintain system integrity.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
11.0%
Prevalence
Low
ksmbd is an opt-in in-kernel SMB server, uncommon versus userspace Samba
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 11.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

57
Low Medium High Critical
KEV: 0
EPSS: +11
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Related Vulnerabilities in Linux Kernel Subsystem Memory and Logic Flaws

View all 22
CVE-2026-68432 HIGH
8.8
CVE-2026-68433 HIGH
8.6
CVE-2026-68442 HIGH
7.8
CVE-2026-68430
CVE-2026-68441
CVE-2026-68447 HIGH
7.1
CVE-2026-68450
CVE-2026-68448
CVE-2026-68444
CVE-2026-68429
CVE-2026-68435
CVE-2026-68439
CVE-2026-68436
CVE-2026-68437
CVE-2026-68449
CVE-2026-68443
CVE-2026-68434
CVE-2026-68438
CVE-2026-68440 HIGH
7.8
CVE-2026-68445 HIGH
7.8
CVE-2026-68446 HIGH
7.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-68431 ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/388888 REF https://git.kernel.org/stable/c/22f1aa35b87e471cc31b35b74451f46630863b12 REF https://git.kernel.org/stable/c/32e486b70c256d5ef4baa5a2936ade2fea50e8eb REF https://git.kernel.org/stable/c/928dda88d0e13fbca381255028f65b244343a4ea REF https://git.kernel.org/stable/c/b62c510f59803f82f9b4c76ead2a56833b2984c7 REF https://git.kernel.org/stable/c/cfc0b8e5080aec87700774e8568765eaa4b7b92b REF https://git.kernel.org/stable/c/d8e5c5672724b8f3c4c099d2cf60239c996e5424 REF https://git.kernel.org/stable/c/d9e9753dfd43bd27c956578df7804a3c90b80fdc

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy