EUVD-2026-80314
GHSA-5h65-jm98-j8f7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local IPC-path OOB read needing low local privilege to shape the ksmbd config response (AV:L/PR:L); yields kernel memory disclosure (C:H) and crash (A:H) with no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: prevent out-of-bounds reads in share config responses
Validate IPC share configuration payload sizes before consuming variable-length fields. Bound veto list parsing and account for the separator byte when deriving the path length.
AnalysisAI
Out-of-bounds reads in the Linux kernel's ksmbd in-kernel SMB3 server can leak kernel memory or crash the system when a local low-privileged attacker can influence the netlink IPC share-configuration response produced by the userspace ksmbd.mountd daemon. The flaw lies in unvalidated variable-length share-config fields - an over-long veto list and a path length that fails to account for the separator byte - and affects kernel series where the fix boundaries listed by EUVD are 5.16, 6.2, 6.7, and 6.9, plus the 7.2.6/7.3-rc2 lines. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ksmbd in-kernel SMB3 server module to be loaded and serving shares (non-default on most systems, which typically use userspace Samba). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but lower-priority kernel memory-safety issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor patch: update the Linux kernel to a release containing the fix commits f25e93768fcc5d8287e50b1ec52a42e4c276df34 or 61a8d06600c8c397f9a7e01940479d4c94a82f5f from the stable tree (https://git.kernel.org/stable/c/f25e93768fcc5d8287e50b1ec52a42e4c276df34 and https://git.kernel.org/stable/c/61a8d06600c8c397f9a7e01940479d4c94a82f5f), or move to the fixed levels identified by EUVD (5.15.157, 6.1.85, 6.6.26, 6.8.5, and the 7.2.6/7.3-rc2 lines); track the distro vendor's kernel errata and the NVD/VulDB advisories for backport status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux hosts running the ksmbd in-kernel SMB3 server and ksmbd.mountd, confirm whether ksmbd is enabled instead of userspace Samba, and disable or blacklist the ksmbd module where it is not business-required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today