Linux Kernel ksmbd EUVD-2026-26516

Requires local authenticated access to the Linux system with sufficient privileges to communicate with the ksmbd userspace daemon's IPC interface. Specifically, the attacker must be able to send crafted responses to the kernel ksmbd module through the /dev/ksmbd-control device or equivalent IPC mechanism, which typically requires membership in the ksmbd administrative group or CAP_SYS_ADMIN capability. The ksmbd kernel module must be loaded and actively handling SMB server operations. Exploitation is limited to systems where ksmbd is explicitly enabled (not the default configuration in most distributions, which use userspace Samba) and where the attacker has gained initial foothold with local shell access. Remote exploitation is not possible (AV:L in CVSS vector). Does not require user interaction (UI:N) and has low attack complexity (AC:L) once local access prerequisites are met.

Real-world exploitation risk is constrained by multiple factors despite the 7.1 CVSS score. Attack vector is local (AV:L) requiring authenticated access (PR:L) to the ksmbd daemon communication channel, limiting exposure to scenarios where attackers have shell access on systems running ksmbd. The EPSS score of 0.02% (5th percentile) indicates security researchers assess exploitation likelihood as very low, consistent with the lack of CISA KEV listing. No publicly available exploit code exists. CVSS vector shows high confidentiality and availability impact but requires low attack complexity, suggesting reliable exploitation is feasible once local access is obtained. However, ksmbd adoption remains limited compared to userspace Samba, reducing attack surface in production environments. The SSVC framework factors suggest exploitation is not currently observed, requires authentication (not automatable), and has localized technical impact. Priority should focus on systems with untrusted local users or containers sharing the host kernel where privilege escalation chains could leverage this primitive. The availability of vendor patches across all affected stable kernel branches (5.15.x, 6.12.x, 6.18.x, 7.0.x, 7.1-rc) significantly reduces risk for organizations maintaining current patch levels.

An authenticated attacker with local shell access on a Linux system running ksmbd crafts malicious responses to the kernel's IPC validation function. By sending a LOGIN_REQUEST_EXT response with ngroups set to a large negative value (e.g., -1), the signed-to-unsigned conversion produces SIZE_MAX, which when multiplied by sizeof(gid_t) and added to the struct size, wraps to a small value matching the actual message buffer size. The validation check passes, and subsequent kmemdup in ksmbd_alloc_user trusts the corrupted ngroups value, triggering out-of-bounds memory access that could enable information disclosure from kernel memory or denial-of-service through kernel panic.