Linux Kernel EUVD-2026-28668

Requires SMB3 encryption enabled on the Linux client (typically via mount option seal=1 or server-enforced encryption). Must involve specific write operations: special file creation (SFU mknod), symlink creation, or on kernels before 6.10, any synchronous write operation. Critically depends on network instability or server errors that trigger SMB client retry logic during the write operation - stable network connections will not manifest the bug. The vulnerability occurs during normal legitimate SMB operations rather than requiring attacker-initiated requests, but exploitation is limited to scenarios where (1) encrypted SMB writes are used, (2) network conditions cause retries, and (3) specific file operation types are in use. Does not require authentication beyond normal SMB access since it affects the client-side encryption process. Async write paths are NOT affected as they use different buffer handling (rq_iter with deep-copy semantics).

Despite the high CVSS base score of 8.1, real-world risk is moderate and highly conditional. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-exploitable with low complexity but requires user interaction, which is somewhat misleading - the 'user interaction' here means a legitimate SMB write operation must occur during a network instability event. The actual attack complexity is higher than CVSS suggests because exploitation requires: (1) SMB3 encryption enabled, (2) specific file operations (special files or pre-6.10 sync writes), and (3) concurrent network instability triggering retry logic. The EPSS score of 0.01% (1st percentile) correctly reflects that this is not being exploited in practice, as it manifests as data corruption during legitimate operations rather than a remotely triggerable attack vector. No CISA KEV listing and no public POC exist. The integrity and availability impacts are real but limited to contexts where encrypted SMB writes retry - primarily affecting environments with unstable SMB connections to Linux servers/clients. SSVC assessment: exploitation status is none, technical impact is partial (data corruption in specific write scenarios), automatable is no (requires environmental conditions). This is a reliability/data integrity bug that security teams discovered rather than a typical attack surface. Priority should be moderate for environments using SMB3 encryption heavily; lower for others.

A user or application initiates an SMB3 encrypted write operation (such as creating a special file via mknod or a symlink over SMB) to a remote server from a Linux client with an unstable network connection. During transmission, a network glitch or server-side transient error occurs, triggering the SMB client's retry logic. The client re-sends the write request, but the payload buffer has already been encrypted in place from the first attempt. The server receives double-encrypted data, cannot decrypt it properly, and either corrupts the written file or fails the operation entirely. This results in data integrity loss or service disruption. The vulnerability manifests through legitimate operations rather than attacker-initiated actions, making it primarily a reliability/corruption issue rather than a security exploit, though an attacker with network position could potentially trigger retries via packet drops to induce corruption.