Linux ksmbd CVE-2026-68431

Update to a kernel that contains the fix commits b62c510f59803f82f9b4c76ead2a56833b2984c7 and cfc0b8e5080aec87700774e8568765eaa4b7b92b, which are backported across the affected stable branches (upgrade past 5.15.145/6.1.34/6.3.8 lines to the corresponding fixed stable release from your distribution; released tag numbers should be confirmed against your vendor's kernel package). Patch references are the kernel.org stable commits at https://git.kernel.org/stable/c/b62c510f59803f82f9b4c76ead2a56833b2984c7 and https://git.kernel.org/stable/c/cfc0b8e5080aec87700774e8568765eaa4b7b92b. Where immediate patching is not possible, the highest-value compensating control is to stop or unload the ksmbd server (disable the CONFIG_SMB_SERVER service or migrate SMB sharing to userspace Samba), which fully removes exposure at the cost of losing in-kernel SMB serving; if ksmbd must remain running, restrict TCP/445 with a host or network firewall to trusted management subnets only, accepting that legitimate SMB clients outside those subnets will lose access. Avoid negotiating down to SMB 2.1 where transform handling is absent, though firewalling the port is the more reliable mitigation.