CVE-2026-68431 (GCVE-0-2026-68431)
Vulnerability from cvelistv5
Published
2026-08-12 00:07
Modified
2026-08-23 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate minimum PDU size for transform requests
The receive path applies the minimum SMB2 PDU size check only when
ProtocolId is SMB2_PROTO_NUMBER. A packet carrying
SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated
dialect does not provide transform handling.
On an SMB 2.1 connection, a short transform packet therefore reaches
init_smb2_rsp_hdr(), which interprets the request as a full SMB2 header
and reads beyond the request allocation. The copied fields can then be
returned to the unauthenticated client.
Compression transforms are converted to ordinary SMB2 messages before
protocol validation. After that conversion, validate ordinary SMB2
requests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption
transform requests to contain both a transform header and an SMB2
header. This rejects truncated requests before work allocation.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: df3a4518aee64f21bcafa891105b468413f27431 Version: 543c12c2644e772caa6880662c2a852cfdc5a10c Version: 368ba06881c395f1c9a7ba22203cf8d78b4addc0 Version: 368ba06881c395f1c9a7ba22203cf8d78b4addc0 Version: 368ba06881c395f1c9a7ba22203cf8d78b4addc0 Version: 368ba06881c395f1c9a7ba22203cf8d78b4addc0 Version: 368ba06881c395f1c9a7ba22203cf8d78b4addc0 Version: e9cb7be2fcbaee9e808b729e92948d38d52e5add Version: 5.15.145 ≤ Version: 6.1.34 ≤ Version: 6.3.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/connection.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22f1aa35b87e471cc31b35b74451f46630863b12",
"status": "affected",
"version": "df3a4518aee64f21bcafa891105b468413f27431",
"versionType": "git"
},
{
"lessThan": "928dda88d0e13fbca381255028f65b244343a4ea",
"status": "affected",
"version": "543c12c2644e772caa6880662c2a852cfdc5a10c",
"versionType": "git"
},
{
"lessThan": "d8e5c5672724b8f3c4c099d2cf60239c996e5424",
"status": "affected",
"version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
"versionType": "git"
},
{
"lessThan": "32e486b70c256d5ef4baa5a2936ade2fea50e8eb",
"status": "affected",
"version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
"versionType": "git"
},
{
"lessThan": "d9e9753dfd43bd27c956578df7804a3c90b80fdc",
"status": "affected",
"version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
"versionType": "git"
},
{
"lessThan": "b62c510f59803f82f9b4c76ead2a56833b2984c7",
"status": "affected",
"version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
"versionType": "git"
},
{
"lessThan": "cfc0b8e5080aec87700774e8568765eaa4b7b92b",
"status": "affected",
"version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
"versionType": "git"
},
{
"status": "affected",
"version": "e9cb7be2fcbaee9e808b729e92948d38d52e5add",
"versionType": "git"
},
{
"lessThan": "5.15.217",
"status": "affected",
"version": "5.15.145",
"versionType": "semver"
},
{
"lessThan": "6.1.184",
"status": "affected",
"version": "6.1.34",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/connection.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.15.145",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "6.1.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate minimum PDU size for transform requests\n\nThe receive path applies the minimum SMB2 PDU size check only when\nProtocolId is SMB2_PROTO_NUMBER. A packet carrying\nSMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated\ndialect does not provide transform handling.\n\nOn an SMB 2.1 connection, a short transform packet therefore reaches\ninit_smb2_rsp_hdr(), which interprets the request as a full SMB2 header\nand reads beyond the request allocation. The copied fields can then be\nreturned to the unauthenticated client.\n\nCompression transforms are converted to ordinary SMB2 messages before\nprotocol validation. After that conversion, validate ordinary SMB2\nrequests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption\ntransform requests to contain both a transform header and an SMB2\nheader. This rejects truncated requests before work allocation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ksmbd is the in-kernel SMB server on TCP/445; the malformed short SMB2_TRANSFORM PDU is delivered entirely as remote network data in ksmbd_conn_handler_loop(), and the leaked bytes are returned in the network response. No local access is involved.\nAC:L - The attacker connects, sends a NEGOTIATE selecting dialect 2.1 (permitted by default since ksmbd_min_protocol() is SMB21_PROT), then a 35-byte packet with ProtocolId 0xFD\u0027SMB\u0027; the undersized-buffer header copy happens deterministically with no race, timing, or memory-layout dependency.\nPR:N - Only NEGOTIATE is required to reach the flaw, which precedes SESSION_SETUP; smb2_check_user_session() fails after the out-of-bounds copy has already been made, so the disclosure is delivered to a fully unauthenticated client.\nUI:N - The attacker drives the entire exchange from a single TCP connection; no action by any local user, administrator, or SMB client is needed.\nS:U - The out-of-bounds read and the disclosed data remain within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - init_smb2_rsp_hdr() reads a 64-byte smb2_hdr out of a ~40-byte kvmalloc allocation and echoes MessageId, ProcessId, TreeId, SessionId and 16 Signature bytes back to the client, disclosing ~28 bytes of uninitialized and adjacent kmalloc-64 heap contents per request, repeatable at will as a remote heap/KASLR oracle.\nI:N - The defect is a read past the request allocation; no attacker-controlled data is written into kernel memory and no kernel or filesystem state is modified by the truncated transform request.\nA:H - The header copy reads past the end of the slab object; on KASAN, hardware tag-based KASAN (MTE), or slub_debug/hardened builds this is a fatal report, and any such unchecked out-of-bounds kernel access is treated as crash-capable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:22.134Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22f1aa35b87e471cc31b35b74451f46630863b12"
},
{
"url": "https://git.kernel.org/stable/c/928dda88d0e13fbca381255028f65b244343a4ea"
},
{
"url": "https://git.kernel.org/stable/c/d8e5c5672724b8f3c4c099d2cf60239c996e5424"
},
{
"url": "https://git.kernel.org/stable/c/32e486b70c256d5ef4baa5a2936ade2fea50e8eb"
},
{
"url": "https://git.kernel.org/stable/c/d9e9753dfd43bd27c956578df7804a3c90b80fdc"
},
{
"url": "https://git.kernel.org/stable/c/b62c510f59803f82f9b4c76ead2a56833b2984c7"
},
{
"url": "https://git.kernel.org/stable/c/cfc0b8e5080aec87700774e8568765eaa4b7b92b"
}
],
"title": "ksmbd: validate minimum PDU size for transform requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68431",
"datePublished": "2026-08-12T00:07:17.216Z",
"dateReserved": "2026-07-30T09:28:09.393Z",
"dateUpdated": "2026-08-23T12:46:22.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…