{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68431", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.393Z", "datePublished": "2026-08-12T00:07:17.216Z", "dateUpdated": "2026-08-23T12:46:22.134Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:22.134Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate minimum PDU size for transform requests\n\nThe receive path applies the minimum SMB2 PDU size check only when\nProtocolId is SMB2_PROTO_NUMBER. A packet carrying\nSMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated\ndialect does not provide transform handling.\n\nOn an SMB 2.1 connection, a short transform packet therefore reaches\ninit_smb2_rsp_hdr(), which interprets the request as a full SMB2 header\nand reads beyond the request allocation. The copied fields can then be\nreturned to the unauthenticated client.\n\nCompression transforms are converted to ordinary SMB2 messages before\nprotocol validation. After that conversion, validate ordinary SMB2\nrequests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption\ntransform requests to contain both a transform header and an SMB2\nheader. This rejects truncated requests before work allocation." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - ksmbd is the in-kernel SMB server on TCP/445; the malformed short SMB2_TRANSFORM PDU is delivered entirely as remote network data in ksmbd_conn_handler_loop(), and the leaked bytes are returned in the network response. No local access is involved.\nAC:L - The attacker connects, sends a NEGOTIATE selecting dialect 2.1 (permitted by default since ksmbd_min_protocol() is SMB21_PROT), then a 35-byte packet with ProtocolId 0xFD'SMB'; the undersized-buffer header copy happens deterministically with no race, timing, or memory-layout dependency.\nPR:N - Only NEGOTIATE is required to reach the flaw, which precedes SESSION_SETUP; smb2_check_user_session() fails after the out-of-bounds copy has already been made, so the disclosure is delivered to a fully unauthenticated client.\nUI:N - The attacker drives the entire exchange from a single TCP connection; no action by any local user, administrator, or SMB client is needed.\nS:U - The out-of-bounds read and the disclosed data remain within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - init_smb2_rsp_hdr() reads a 64-byte smb2_hdr out of a ~40-byte kvmalloc allocation and echoes MessageId, ProcessId, TreeId, SessionId and 16 Signature bytes back to the client, disclosing ~28 bytes of uninitialized and adjacent kmalloc-64 heap contents per request, repeatable at will as a remote heap/KASLR oracle.\nI:N - The defect is a read past the request allocation; no attacker-controlled data is written into kernel memory and no kernel or filesystem state is modified by the truncated transform request.\nA:H - The header copy reads past the end of the slab object; on KASAN, hardware tag-based KASAN (MTE), or slub_debug/hardened builds this is a fatal report, and any such unchecked out-of-bounds kernel access is treated as crash-capable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/connection.c" ], "versions": [ { "version": "df3a4518aee64f21bcafa891105b468413f27431", "lessThan": "22f1aa35b87e471cc31b35b74451f46630863b12", "status": "affected", "versionType": "git" }, { "version": "543c12c2644e772caa6880662c2a852cfdc5a10c", "lessThan": "928dda88d0e13fbca381255028f65b244343a4ea", "status": "affected", "versionType": "git" }, { "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0", "lessThan": "d8e5c5672724b8f3c4c099d2cf60239c996e5424", "status": "affected", "versionType": "git" }, { "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0", "lessThan": "32e486b70c256d5ef4baa5a2936ade2fea50e8eb", "status": "affected", "versionType": "git" }, { "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0", "lessThan": "d9e9753dfd43bd27c956578df7804a3c90b80fdc", "status": "affected", "versionType": "git" }, { "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0", "lessThan": "b62c510f59803f82f9b4c76ead2a56833b2984c7", "status": "affected", "versionType": "git" }, { "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0", "lessThan": "cfc0b8e5080aec87700774e8568765eaa4b7b92b", "status": "affected", "versionType": "git" }, { "version": "e9cb7be2fcbaee9e808b729e92948d38d52e5add", "status": "affected", "versionType": "git" }, { "version": "5.15.145", "lessThan": "5.15.217", "status": "affected", "versionType": "semver" }, { "version": "6.1.34", "lessThan": "6.1.184", "status": "affected", "versionType": "semver" }, { "version": "6.3.8", "lessThan": "6.4", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/smb/server/connection.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.145", "versionEndExcluding": "5.15.217" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.34", "versionEndExcluding": "6.1.184" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.153" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.105" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.46" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/22f1aa35b87e471cc31b35b74451f46630863b12" }, { "url": "https://git.kernel.org/stable/c/928dda88d0e13fbca381255028f65b244343a4ea" }, { "url": "https://git.kernel.org/stable/c/d8e5c5672724b8f3c4c099d2cf60239c996e5424" }, { "url": "https://git.kernel.org/stable/c/32e486b70c256d5ef4baa5a2936ade2fea50e8eb" }, { "url": "https://git.kernel.org/stable/c/d9e9753dfd43bd27c956578df7804a3c90b80fdc" }, { "url": "https://git.kernel.org/stable/c/b62c510f59803f82f9b4c76ead2a56833b2984c7" }, { "url": "https://git.kernel.org/stable/c/cfc0b8e5080aec87700774e8568765eaa4b7b92b" } ], "title": "ksmbd: validate minimum PDU size for transform requests", "x_generator": { "engine": "bippy-1.2.0" } } } }