Skip to main content

Linux ksmbd CVE-2026-90174

| EUVDEUVD-2026-81767 HIGH
2026-09-17 Linux GHSA-xjjr-rjj9-3w22
Buffer Overflow Linux Debian Ksmbd
7.1
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain control of mountd IPC/netlink channel
  2. Delivery
    Send login response with oversized hash_sz
  3. Exploit
    Trigger unbounded memcpy in ksmbd_alloc_user()
  4. Execution
    Read past kmalloc-192 slab object
  5. Impact
    Kernel oops / adjacent-memory disclosure

Vulnerability Assessment

Exploitation Conditions

Requires the kernel built and running with ksmbd (CONFIG_SMB_SERVER) as an active SMB server. The malicious data is the mountd IPC login response delivered over generic-netlink to the ksmbd family, so exploitation requires the ability to control, spoof, or compromise that privileged userspace-to-kernel IPC channel (normally the ksmbd.mountd daemon, reachable via CAP_NET_ADMIN-class netlink). The oversized hash_sz is processed during NTLM authentication in SMB2 session setup. Limiting factors: ksmbd is a non-default, opt-in feature; the attacker must influence the trusted mountd IPC response rather than send a plain network SMB packet; the primary observable effect is a kernel crash (DoS) with only partial adjacent-memory disclosure.
Impact

This is a slab-out-of-bounds READ (KASAN-confirmed) in ksmbd_alloc_user(), triggered when the kernel copies resp->hash_sz bytes (a __u16 that may reach 65535) out of a fixed KSMBD_REQ_MAX_HASH_SZ hash[] buffer received in the mountd IPC login response. The vendor CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (7.1) is directionally right on locality but overstates impact: an OOB read manifests here primarily as a kernel crash/oops (A:H) and at most a partial leak of adjacent kernel memory into user->passkey (C:L, not C:H), with no integrity impact (I:N is consistent). The malicious/malformed data originates from the ksmbd.mountd userspace daemon over generic-netlink, so triggering it requires being - or compromising/spoofing - that privileged IPC channel (typically CAP_NET_ADMIN-class netlink send), which argues for PR:H rather than PR:L. This is fundamentally a kernel-hardening-against-malicious-userspace fix. No EPSS, no CISA KEV entry, and no public exploit are present in the input, so this is not an active-exploitation priority; it is a legitimate memory-safety bug in an opt-in server component. Key conflict to verify: vendor C:H versus the read-only/DoS nature of the flaw, and PR:L versus the privileged mountd IPC prerequisite.
Exploit ScenarioDerived

An attacker who controls or can inject into the ksmbd.mountd IPC channel (or a compromised/malfunctioning mountd) sends an NTLM login response with hash_sz set well beyond KSMBD_REQ_MAX_HASH_SZ. During SMB2 session setup, ksmbd_alloc_user() memcpy's up to 65535 bytes from the small hash[] buffer, reading past the kmalloc-192 object and crashing the kernel (or copying adjacent slab memory into the passkey). No public exploit code is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

The Linux kernel's in-kernel SMB server, ksmbd (CONFIG_SMB_SERVER), can be driven to read up to 65535 bytes past the end of a fixed-size hash buffer during NTLM authentication, producing a KASAN-confirmed slab-out-of-bounds read and a kernel crash (denial of service) with only partial adjacent-memory disclosure. Exploitation is not achieved with a plain remote SMB packet: the oversized hash_sz value arrives in the mountd IPC login response delivered over the ksmbd generic-netlink family, so the attacker must control, spoof, or compromise that privileged userspace-to-kernel channel (normally the ksmbd.mountd daemon, reachable with CAP_NET_ADMIN-class access), which is why the assessed vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H rather than a network-vector issue. ksmbd is a non-default, opt-in feature, which materially narrows the exposed population, and no public exploit code was identified at time of analysis.

RemediationAI

Upgrade to a kernel containing the fix: Linux 7.2.6 or Linux 7.3-rc1 (or later), or apply the corresponding stable backports from git.kernel.org commits 497c221bf6b2f659511719a6acfae84cc1be1caf and 7405d0ba294306721843bc551611775e6edef516 to kernels that have not yet picked them up; a vendor patch is available, and NVD's entry (https://nvd.nist.gov/vuln/detail/CVE-2026-90174) plus EUVD-2026-81767 can be used to track redistribution. If immediate patching is not possible, the most effective compensating control is to not run ksmbd at all: either build the kernel without CONFIG_SMB_SERVER or blacklist/do not load the ksmbd module, which removes the attack surface entirely but disables in-kernel SMB file sharing (use a userspace Samba daemon instead if sharing is required). Where ksmbd must stay enabled, harden the IPC trust boundary, since the bug is only reachable by influencing the generic-netlink login response: restrict access to the ksmbd netlink family to the legitimate ksmbd.mountd process (netlink sockets are already gated by CAP_NET_ADMIN-class privilege, so audit which processes/containers hold that capability and drop it wherever possible), ensure ksmbd.mountd itself is not attacker-writable or replaceable via path/loader hijacking, and monitor for ksmbd worker crashes or KASAN 'slab-out-of-bounds in ksmbd_alloc_user' reports as a detection signal. Be aware that these mitigations do not fix the underlying missing hash_sz bound; they only reduce the likelihood that an attacker can reach the malformed response path, and disabling ksmbd is the only fully reliable workaround short of patching.

Affected VersionsENISA

Linux patch: 7.2.6
Linux e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <7405d0ba294306721843bc551611775e6edef516
Linux e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <497c221bf6b2f659511719a6acfae84cc1be1caf
Linux patch: 7.3-rc1
Linux 5.15
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

ksmbd is the in-kernel SMB/CIFS server merged into the Linux kernel (introduced in the 5.15 timeframe, per the EUVD version data). In addition to handling SMB2 session setup and NTLM authentication, it communicates with a userspace helper, ksmbd.mountd, over a generic-netlink family; authentication decisions come back to the kernel inside IPC message structures. The vulnerable path is ksmbd_alloc_user(), reached from ksmbd_login_user() during ntlm_authenticate() in smb2_sess_setup(). The function copies resp->hash_sz bytes from resp->hash into a freshly allocated buffer (user->passkey = kmalloc(resp->hash_sz, ...) followed by memcpy(..., resp->hash, resp->hash_sz)), but resp->hash[] is only KSMBD_REQ_MAX_HASH_SZ bytes while hash_sz is an attacker-influenced __u16 that can reach 65535. Because ipc_validate_msg() never bounds hash_sz, the memcpy() walks off the end of the response object - an out-of-bounds read in the CWE-125 class - as confirmed by the KASAN report ('slab-out-of-bounds in ksmbd_alloc_user', 'Read of size 65535', object in the kmalloc-192 cache). The fix adds a length check rejecting any response whose hash_sz exceeds the on-stack hash[] buffer before the allocation and copy. The root cause is a missing validation of a length field taken from an IPC-provided structure and then used directly as a memcpy size, i.e., a trust-boundary failure between the privileged mountd helper and the kernel.

Know when Ksmbd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 5.1 MEDIUM

Bad data arrives via the privileged mountd genl IPC channel (AV:L/PR:H), reliably crashes the kernel (A:H), and only partially leaks adjacent slab memory (C:L), with no integrity impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 2.3 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 18, 2026 - 18:22 NVD
7.1 (HIGH)
Patch available
Sep 17, 2026 - 17:19 EUVD
CVE Published
Sep 17, 2026 - 16:07 cve.org
HIGH 7.1
CVE Published
Sep 17, 2026 - 16:07 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()

ksmbd_alloc_user() copies resp->hash_sz bytes out of the mountd IPC login response with

user->passkey_sz = resp->hash_sz; user->passkey = kmalloc(resp->hash_sz, KSMBD_DEFAULT_GFP); if (user->passkey) memcpy(user->passkey, resp->hash, resp->hash_sz);

resp->hash_sz is a __u16 supplied by the response, but resp->hash[] is only KSMBD_REQ_MAX_HASH_SZ bytes. A malformed or malicious login response can set hash_sz well beyond that (up to 65535), so the memcpy() reads past the end of the response object. ipc_validate_msg() does not bound hash_sz, so reject any response whose hash_sz exceeds the on-stack hash[] buffer before allocating and copying.

[ 2030.238706] BUG: KASAN: slab-out-of-bounds in ksmbd_alloc_user+0x278/0x680 [ 2030.240549] Read of size 65535 at addr ffff888121bb6680 by task kworker/4:1/18611 [ 2030.242296] [ 2030.242710] CPU: 4 UID: 0 PID: 18611 Comm: kworker/4:1 Not tainted 7.1.0-next-20260623-virtme #96 PREEMPT(lazy) [ 2030.242732] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 [ 2030.242743] Workqueue: ksmbd-io handle_ksmbd_work [ 2030.242763] Call Trace: [ 2030.242769] <TASK> [ 2030.242776] dump_stack_lvl+0xa2/0xd0 [ 2030.242794] print_address_description+0x77/0x200 [ 2030.242815] ? ksmbd_alloc_user+0x278/0x680 [ 2030.242831] print_report+0x58/0x70 [ 2030.242848] kasan_report+0x117/0x150 [ 2030.242869] ? ksmbd_alloc_user+0x278/0x680 [ 2030.242888] kasan_check_range+0x3c7/0x3f0 [ 2030.242908] ? ksmbd_alloc_user+0x278/0x680 [ 2030.242925] __asan_memcpy+0x29/0x70 [ 2030.242942] ksmbd_alloc_user+0x278/0x680 [ 2030.242960] ksmbd_login_user+0xc3/0x120 [ 2030.242978] ntlm_authenticate+0x5e6/0x1b00 [ 2030.243017] ? __pfx_ntlm_authenticate+0x10/0x10 [ 2030.243035] ? ksmbd_session_lookup+0x188/0x1d0 [ 2030.243054] ? __pfx_ksmbd_session_lookup+0x10/0x10 [ 2030.243090] ? __sanitizer_cov_trace_switch+0x7b/0x140 [ 2030.243108] smb2_sess_setup+0x1e4a/0x27b0 [ 2030.243126] ? copy_from_kernel_nofault+0x199/0x300 [ 2030.243156] ? __pfx_smb2_sess_setup+0x10/0x10 [ 2030.243173] ? get_smb2_cmd_val+0xe3/0x1c0 [ 2030.243208] handle_ksmbd_work+0x954/0x1280 [ 2030.243230] ? __pfx_handle_ksmbd_work+0x10/0x10 [ 2030.243249] ? process_scheduled_works+0xa07/0x1490 [ 2030.243270] ? process_scheduled_works+0xa07/0x1490 [ 2030.243291] process_scheduled_works+0xa70/0x1490 [ 2030.243320] ? __pfx_process_scheduled_works+0x10/0x10 [ 2030.243340] ? do_raw_spin_lock+0x130/0x300 [ 2030.243358] ? lock_is_held_type+0x7b/0x110 [ 2030.243388] worker_thread+0x932/0xe20 [ 2030.243415] kthread+0x38a/0x470 [ 2030.243431] ? __pfx_worker_thread+0x10/0x10 [ 2030.243451] ? __pfx_kthread+0x10/0x10 [ 2030.243467] ret_from_fork+0x484/0x910 [ 2030.243485] ? __pfx_ret_from_fork+0x10/0x10 [ 2030.243501] ? __switch_to+0xc77/0x12c0 [ 2030.243523] ? __pfx_kthread+0x10/0x10 [ 2030.243540] ret_from_fork_asm+0x1a/0x30 [ 2030.243564] </TASK> [ 2030.243570] [ 2030.290164] Allocated by task 19279: [ 2030.290911] kasan_save_track+0x3e/0x80 [ 2030.292179] __kasan_kmalloc+0x72/0x90 [ 2030.293217] __kvmalloc_node_noprof+0x3ff/0x6b0 [ 2030.294467] handle_generic_event+0x59b/0x750 [ 2030.295345] genl_family_rcv_msg_doit+0x238/0x340 [ 2030.296553] genl_rcv_msg+0x606/0x7b0 [ 2030.297129] netlink_rcv_skb+0x22b/0x4a0 [ 2030.298500] genl_rcv+0x2d/0x40 [ 2030.299273] netlink_unicast+0x7ba/0x930 [ 2030.300019] netlink_sendmsg+0x8c3/0xb00 [ 2030.301073] __sock_sendmsg+0xec/0x140 [ 2030.301579] __sys_sendto+0x357/0x470 [ 2030.302255] __x64_sys_sendto+0xe3/0x100 [ 2030.303425] do_syscall_64+0x135/0x460 [ 2030.304763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2030.305594] [ 2030.305819] The buggy address belongs to the object at ffff888121bb6640 [ 2030.305819] which belongs to the cache kmalloc-192 of size 192 [ 2030.309595] The buggy address ---truncated---

Executive ViewAI

Why It Matters

A memory-safety flaw in the Linux kernel's optional in-kernel SMB file server (ksmbd) can crash the kernel and leak limited adjacent memory when a privileged local actor controls or compromises the userspace daemon that brokers SMB authentication. Because ksmbd is a non-default, opt-in component and exploitation requires high privileges on the host, the realistic business exposure is limited to servers where that feature was deliberately enabled - primarily file-sharing workloads where an availability outage would disrupt teams. Leadership should care only if ksmbd is in active use in your environment, since the practical outcome there is unplanned downtime rather than remote compromise.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 91% exploitable
Prevalence
Low
Linux is ubiquitous but ksmbd (CONFIG_SMB_SERVER) is opt-in and rarely enabled
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Ksmbd

View all
CVE-2026-98115 HIGH
8.8 Sep 25

A use-after-free race condition in the Linux kernel's ksmbd in-kernel SMB3 server can crash the kernel (denial of servic
CVE-2026-90162 HIGH
8.8 Sep 17

Kernel memory corruption in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client trigger a u
CVE-2026-8449 HIGH
8.7 May 12

Heap out-of-bounds read and subsequent heap corruption in the Linux kernel's in-kernel SMB server (ksmbd) lets an authen
CVE-2026-90176 HIGH
8.1 Sep 17

Mandatory byte-range lock enforcement is bypassed in the Linux kernel's in-kernel ksmbd SMB server, letting a client wit
CVE-2026-98112 HIGH
7.8 Sep 25

Use-after-free race in the Linux kernel's ksmbd SMB3 server can be triggered when a network-device event such as an inte
CVE-2021-45100 HIGH
7.5 Dec 16

The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even tho

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-90174 ADVISORY https://vuldb.com/vuln/406683 REF https://git.kernel.org/stable/c/272c05a51285fe3495ab2f7eb77a48ad831b929f REF https://git.kernel.org/stable/c/497c221bf6b2f659511719a6acfae84cc1be1caf REF https://git.kernel.org/stable/c/67223b1150a9edea52350d8cd085ea9081beaa45 REF https://git.kernel.org/stable/c/7405d0ba294306721843bc551611775e6edef516 REF https://git.kernel.org/stable/c/792dd35013427995e742c7928ef5b564434a4321 REF https://git.kernel.org/stable/c/863f74ad158fef2987b9146f29d4b3149bb95953

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy