Skip to main content

ksmbd CVE-2026-68457

| EUVDEUVD-2026-59079 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-j57w-wqmx-67hp
Information Disclosure Linux Red Hat Suse
9.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
8.1 HIGH

Network SMB service but exploitation requires an authenticated SMB session and an open handle, so PR:L; impact is integrity and availability of file data (zeroing/attribute change) with no confidentiality loss, so C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
9.1 HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:56 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.1 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:17 cve.org
CRITICAL 9.1
CVE Published
Aug 15, 2026 - 06:17 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: use opener credentials for FSCTL mutations

SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers can revalidate inode permissions, ownership and LSM policy independently of the SMB handle access mask.

Run each operation with the credentials captured in the target file when the handle was opened. Keep credential handling local to these single-file FSCTLs rather than applying session credentials to the complete IOCTL handler, which also contains handle-less and multi-handle operations.

AnalysisAI

Improper credential context in the Linux kernel's in-kernel SMB3 server (ksmbd) allows an attacker with an open SMB handle to have SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION FSCTL operations executed under the ksmbd worker's credentials instead of the credentials captured when the file was opened. Because the underlying VFS xattr, fallocate and fileattr helpers revalidate inode permissions, ownership and LSM policy against those worker credentials rather than the SMB handle's access mask, an attacker can corrupt or zero file data and alter file attributes beyond what their handle should permit (CVSS 9.1, I:H/A:H). There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV; the upstream fix is merged into stable kernels.

Technical ContextAI

ksmbd is the kernel-space SMB2/SMB3 file server introduced in Linux 5.15, an alternative to userspace Samba that services CIFS/SMB clients directly from a kernel worker thread (kworker/ksmbd daemon). The affected FSCTLs - FSCTL_SET_SPARSE, FSCTL_SET_ZERO_DATA and FSCTL_SET_COMPRESSION - act on a single open handle and translate into VFS-layer operations: extended-attribute writes, fallocate/punch-hole calls, and fileattr (ioctl-style attribute) changes. The root cause is a privilege/credential context confusion (a confused-deputy class issue, akin to CWE-282 improper ownership management / CWE-863 incorrect authorization; NVD lists CWE as N/A): the helpers re-check permissions, ownership and LSM (e.g. SELinux/AppArmor) policy, but they were invoked with the current ksmbd worker task credentials rather than the credentials snapshotted in the struct file at open time. The fix wraps each single-file FSCTL in the opener's captured credentials, deliberately scoped to these single-handle operations rather than the whole IOCTL handler, which also serves handle-less and multi-handle paths that must keep worker credentials.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 or later (fix also in 7.2-rc1) - via your distribution's kernel update channel, then reboot (or apply the corresponding livepatch if offered). The corresponding upstream commits are available at git.kernel.org (commit e205f3e7e8c31a47cd11efb6cf663a527177e432 and the related stable backports). If immediate patching is not possible, the most effective compensating control is to disable or unload the ksmbd module (rmmod ksmbd / blacklist it) and use userspace Samba instead, which removes the vulnerable code path entirely at the cost of the in-kernel server's performance; where ksmbd must run, restrict exposure by firewalling TCP 445 to trusted management networks and requiring authenticated (non-guest) share access with least-privilege share permissions, which limits who can obtain the open handle needed to reach the FSCTLs. Note these network/config controls reduce reachability but do not fix the underlying credential mismatch - only the kernel update does.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68457 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy