Linux kernel ksmbd EUVD-2026-55264

Requires (1) a Linux host running the in-kernel ksmbd SMB server with at least one exported share, (2) an authenticated SMB session with rights to perform create/mkdir/hardlink operations on that share, and (3) winning a TOCTOU race in which a path component is absent when the LOOKUP_BENEATH open lookup runs (returning -ENOENT and taking the create branch) but present as a directory when the create walk runs, using a crafted path containing a '..' component. Limiting factors: authentication is required despite the CVSS PR:N rating, the race is not guaranteed to succeed per attempt (real AC is High), and hosts not running ksmbd or not exporting writable shares are unaffected. This is not remote-unauthenticated against a default configuration - ksmbd is an opt-in, non-default feature.

Signals conflict and must be weighed. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H = 9.1 Critical) implies trivial unauthenticated network exploitation, but the description explicitly requires an 'authenticated client' plus a won TOCTOU race - so PR:N and AC:L are optimistic; realistically this is PR:L and AC:H, which materially lowers exploitability. EPSS agrees with the harder-than-it-looks reading: 0.17% (6th percentile), and the CVE is not in CISA KEV, so there is no evidence of active or widespread exploitation. No SSVC decision and no POC are provided. The input 'Information Disclosure' tag also conflicts with the CVSS impact (C:N, I:H/A:H); a share escape via hardlink creation could in fact yield confidentiality impact, so C:N is arguably understated. Net: a genuinely serious confinement bug for anyone running ksmbd, but the race requirement, authentication requirement, and low EPSS make it a patch-in-normal-cycle item rather than an emergency for most, with practical priority hinging on whether ksmbd is enabled at all.

An attacker with valid credentials to a ksmbd share issues an SMB2 create/mkdir for a path whose intermediate component they concurrently create and remove, winning the race so the confined open lookup returns -ENOENT (taking the create branch) while the component exists as a directory during the create walk. The unconfined create walk then follows a '..' component out of the share root, letting the attacker create a file, directory, or hardlink anywhere the ksmbd process can write on the host filesystem. No public POC is identified at time of analysis, and the required TOCTOU race raises practical difficulty.