Skip to main content

Linux ksmbd EUVDEUVD-2026-38734

| CVE-2026-52944 MEDIUM
2026-06-24 Linux GHSA-v762-vr2v-9263
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.1 HIGH

ksmbd is network-exposed via SMB/TCP-445, so AV:N; PR:L reflects required authenticated SMB session; I:L captures unauthorized xattr write; A:H retained for sparse-attribute corruption risk.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 08, 2026 - 19:20 vuln.today
CVSS changed
Jul 08, 2026 - 19:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 11:01 EUVD
CVE Published
Jun 24, 2026 - 09:59 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 09:59 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

FSCTL_SET_SPARSE in fsctl_set_sparse() modifies the file's sparse attribute and saves it through xattr without any permission checks.

This exposes two issues:

  1. A client on a read-only share can change the sparse attribute

on files it opened, even though the share is read-only. Other FSCTL write operations already check test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE), but FSCTL_SET_SPARSE does not.

  1. Even on writable shares, clients without FILE_WRITE_DATA or

FILE_WRITE_ATTRIBUTES access should not modify the sparse attribute. Similar handle-level checks exist in other functions but are missing here.

Add both share-level writable check and per-handle access check. Use goto out on error to avoid leaking file references.

AnalysisAI

Unauthorized file attribute modification in the Linux kernel's ksmbd SMB server allows authenticated SMB clients to invoke FSCTL_SET_SPARSE and alter a file's sparse xattr without required permissions, bypassing both share-level and per-handle access controls. Two distinct authorization gaps exist: clients on read-only shares can issue the control code because fsctl_set_sparse() omits the KSMBD_TREE_CONN_FLAG_WRITABLE check that other FSCTL write operations enforce, and clients on writable shares with insufficient handle rights (lacking FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES) can modify the attribute because per-handle checks are entirely absent. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries an EPSS of 0.22% (12th percentile) - but the exposure surface is any network-reachable ksmbd deployment serving untrusted SMB clients.

Technical ContextAI

ksmbd is the in-kernel SMB3 server implementation merged into the Linux mainline in kernel 5.15, designed as a high-performance alternative to Samba running in kernel space. The vulnerable function fsctl_set_sparse() handles the FSCTL_SET_SPARSE filesystem control code, which toggles a file's sparse attribute - controlling whether unwritten extents are stored as holes rather than zero-filled blocks - and persists that state as a kernel extended attribute (xattr). The authorization gap is structural: the code paths handling other FSCTL write operations already call test_tree_conn_flag(work->tcon, KSMBD_TREE_CONN_FLAG_WRITABLE) for share-level gating and check per-handle access masks, but these guards were never added to fsctl_set_sparse(). An additional resource-management flaw (leaking file references on error) was simultaneously fixed by introducing a goto out pattern. Although the NVD record lists no CWE, the root cause class is CWE-862 (Missing Authorization). Affected CPE: cpe:2.3:a:linux:linux:*.

RemediationAI

The primary remediation is to upgrade the Linux kernel to a patched stable release: 6.6.143, 6.18.35, 7.0.12, or 7.1. The four upstream fix commits at git.kernel.org (referenced above) are suitable for backporting to distributions maintaining their own stable kernels. Where a kernel update cannot be deployed immediately, the most targeted compensating control is to unload the ksmbd module (rmmod ksmbd) and migrate SMB serving to Samba, which does not carry this flaw - though this introduces Samba's own operational overhead and configuration complexity. If ksmbd must remain loaded, restricting SMB access (TCP port 445) at the network perimeter or host firewall to only trusted client IP ranges limits the attack surface without eliminating the vulnerability; untrusted clients who bypass that control retain exploitability. Ensuring all ksmbd shares are configured with authenticated-only access reduces exposure but does not close the handle-level bypass for low-privilege authenticated users.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38734 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy