What is the CVSS score of EUVD-2026-45823?

EUVD-2026-45823 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-45823?

Within 24 hours, identify and inventory Linux systems running ksmbd (active SMB/CIFS shares). Within 7 days, obtain the vendor-released patch for ksmbd, test in a staging environment that mirrors production share configurations, and deploy to production systems, prioritizing internet-facing or externally-accessible shares. Within 30 days, verify patch deployment across all ksmbd hosts and conduct an access-control audit to ensure SMB write permissions are limited to authorized users only.

Linux ksmbd EUVD-2026-45823

Q: Which versions of Linux ksmbd are affected by EUVD-2026-45823?

Linux SMB3 servers (ksmbd) contain a memory access flaw allowing authenticated file-share users to disclose kernel data or cause service outages via crafted security descriptors.. A patch is available.

| CVE-2026-64138 HIGH

2026-07-19 Linux

GHSA-23jx-58r9-pwv6

Information Disclosure Linux

8.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to ksmbd share
Delivery

Plant directory with malformed parent security descriptor
Exploit

Trigger file create for ACL inheritance
Execution

ksmbd reads OOB Owner/Group SID
Impact

Leak kernel memory or crash server

Vulnerability Assessment

Exploitation Conditions	Exploitation requires that the target host runs the in-kernel ksmbd SMB server with at least one exported share, and that the attacker holds an authenticated SMB session (CVSS PR:L) with the ability to influence a parent directory's stored NT Security Descriptor so that ACL inheritance parses attacker-controlled Owner/Group SID offsets. Limiting factors: ksmbd is not enabled by default on most distributions (Samba userspace is the norm), so hosts without ksmbd are not affected; valid share credentials with write/create access are needed (not anonymous/default-unauthenticated), and the malformed security descriptor must be present on the parent object before the vulnerable create operation triggers the read.
Impact	The published CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) rates this High, requiring only a low-privileged authenticated network user with no interaction. However, the intelligence tags label it 'Information Disclosure' and the described fix concerns a bounded SID read, which is more consistent with a kernel memory-disclosure/DoS primitive than reliable high-integrity/high-availability compromise - the full C:H/I:H/A:H may overstate the practical integrity impact, so verify against the vendor commit. Contrasting the signals: EPSS is low (0.17%), the CVE is NOT in CISA KEV, and no POC is referenced, so despite the High CVSS this is not evidence of active or imminent widespread exploitation. Real-world priority is moderated further by the precondition that ksmbd must be deployed and the attacker must already hold authenticated write access to a share - a meaningful gating factor absent from the raw base score.
Exploit ScenarioDerived	An attacker with valid credentials and write access to a ksmbd-exported share plants or manipulates a directory whose stored NT Security Descriptor declares out-of-range Owner/Group SID offsets. When ksmbd performs ACL inheritance on a subsequent file or directory creation under that path, it reads beyond the descriptor buffer, leaking adjacent kernel memory back to the client or crashing the server. No public POC is currently identified, and the low attack complexity means a working exploit would need only authenticated share access.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Out-of-bounds memory access in the Linux kernel's ksmbd (in-kernel SMB3 server) occurs during ACL inheritance, where Owner and Group SIDs read from a parent directory's NT Security Descriptor were used without bounds validation. An authenticated SMB user able to write to a share can craft or place a malformed security descriptor so that a subsequent create operation reads past buffer boundaries, enabling kernel information disclosure and potential denial of service. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 6th percentile).

RemediationAI

Vendor-released patch: upgrade to a fixed Linux stable kernel - 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later within each series), per the git.kernel.org stable commits f0e5c9c663badc9982e6941322eef1cb17de0f11, 18d8db24b0a5b7be4829238dd4022236df02d421, 1c9d0646a9959752f11ca1080dc1ff26bd1756cb, and 69f030cf95488ae1186c72ac8c66fd279664ea7f. If patching cannot be scheduled immediately, the most effective compensating control is to disable the ksmbd server (unload/blacklist the ksmbd kernel module and stop exporting SMB shares via ksmbd), falling back to userspace Samba where SMB service is required - the trade-off is loss of the in-kernel server's performance. Where ksmbd must remain enabled, restrict share access to trusted authenticated principals and remove write permissions from untrusted users, since exploitation requires an authenticated user who can influence a parent directory's security descriptor; also restrict network reachability of SMB (TCP 445) to trusted segments via firewall, accepting reduced client accessibility. Reference the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-64138.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <69f030cf95488ae1186c72ac8c66fd279664ea7f

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <18d8db24b0a5b7be4829238dd4022236df02d421

Linux patch: 6.12.92

Linux 0 <7.0.11

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f0e5c9c663badc9982e6941322eef1cb17de0f11

Linux 0 <6.18.34

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <1c9d0646a9959752f11ca1080dc1ff26bd1756cb

Linux patch: 6.18.34

Linux 0 <6.12.92

Linux patch: 7.0.11

Linux patch: 7.1

Affected Packages

euvd linux fix: 6.12.92, 6.18.34, 7.0.11

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

ksmbd is the Linux kernel's native SMB3 file server, an alternative to the userspace Samba daemon that runs entirely in kernel context, so parsing bugs translate directly into kernel-memory safety issues. When a new file or directory is created on a share, ksmbd performs ACL inheritance by reading the parent directory's stored NT Security Descriptor (smb_ntsd), which contains OwnerSid and GroupSid offset fields pointing into a variable-length blob. Before this fix the code dereferenced those SIDs without confirming that the declared offsets and SID sub-authority counts stayed within the descriptor buffer; the patch adds a smb_validate_ntsd_sid() helper to bounds-check each SID prior to use. The root cause is the missing validation class (out-of-bounds read on attacker-influenced offset data); the CVE lists CWE as N/A, but this maps to CWE-125 (Out-of-bounds Read). Affected component is identified only generically by CPE as cpe:2.3:a:linux:linux:*, which does not isolate the ksmbd module.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 8.1 HIGH

Authenticated SMB user (PR:L) triggers a network-reachable OOB read yielding kernel memory disclosure (C:H) and potential crash (A:H); no clear integrity write, so I:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate SID in parent security descriptor during ACL inheritance

Introduce smb_validate_ntsd_sid() helper to safely validate Owner SID and Group SID inside the NT Security Descriptor (smb_ntsd) retrieved from the parent directory.

Executive ViewAI

Why It Matters

Linux SMB3 servers (ksmbd) contain a memory access flaw allowing authenticated file-share users to disclose kernel data or cause service outages via crafted security descriptors. Organizations hosting shared storage on Linux should patch urgently to prevent potential data exposure and infrastructure downtime.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

Medium

in-kernel SMB server shipped in mainline but enabled only where deployed

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64138 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8593-1 ADVISORY https://vuldb.com/vuln/380332 REF https://git.kernel.org/stable/c/18d8db24b0a5b7be4829238dd4022236df02d421 REF https://git.kernel.org/stable/c/1c9d0646a9959752f11ca1080dc1ff26bd1756cb REF https://git.kernel.org/stable/c/69f030cf95488ae1186c72ac8c66fd279664ea7f REF https://git.kernel.org/stable/c/8efbea0253b7fa2d1960cab0fed36544ca0b41ab REF https://git.kernel.org/stable/c/f0e5c9c663badc9982e6941322eef1cb17de0f11 REF https://git.kernel.org/stable/c/f7c4dee323d9176b8d3f5c69018ee57ae0d4653c

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back