CVE-2026-68431 (GCVE-0-2026-68431)

Vulnerability from cvelistv5 – Published: 2026-08-12 00:07 – Updated: 2026-08-13 22:45
VLAI
Title
ksmbd: validate minimum PDU size for transform requests
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2_PROTO_NUMBER. A packet carrying SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated dialect does not provide transform handling. On an SMB 2.1 connection, a short transform packet therefore reaches init_smb2_rsp_hdr(), which interprets the request as a full SMB2 header and reads beyond the request allocation. The copied fields can then be returned to the unauthenticated client. Compression transforms are converted to ordinary SMB2 messages before protocol validation. After that conversion, validate ordinary SMB2 requests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption transform requests to contain both a transform header and an SMB2 header. This rejects truncated requests before work allocation.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 368ba06881c395f1c9a7ba22203cf8d78b4addc0 , < b62c510f59803f82f9b4c76ead2a56833b2984c7 (git)
Affected: 368ba06881c395f1c9a7ba22203cf8d78b4addc0 , < cfc0b8e5080aec87700774e8568765eaa4b7b92b (git)
Affected: df3a4518aee64f21bcafa891105b468413f27431 (git)
Affected: 543c12c2644e772caa6880662c2a852cfdc5a10c (git)
Affected: e9cb7be2fcbaee9e808b729e92948d38d52e5add (git)
Affected: 5.15.145 , < 5.16 (semver)
Affected: 6.1.34 , < 6.2 (semver)
Affected: 6.3.8 , < 6.4 (semver)
Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc5 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b62c510f59803f82f9b4c76ead2a56833b2984c7",
              "status": "affected",
              "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
              "versionType": "git"
            },
            {
              "lessThan": "cfc0b8e5080aec87700774e8568765eaa4b7b92b",
              "status": "affected",
              "version": "368ba06881c395f1c9a7ba22203cf8d78b4addc0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "df3a4518aee64f21bcafa891105b468413f27431",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "543c12c2644e772caa6880662c2a852cfdc5a10c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e9cb7be2fcbaee9e808b729e92948d38d52e5add",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.145",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.34",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc5",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.145",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate minimum PDU size for transform requests\n\nThe receive path applies the minimum SMB2 PDU size check only when\nProtocolId is SMB2_PROTO_NUMBER. A packet carrying\nSMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated\ndialect does not provide transform handling.\n\nOn an SMB 2.1 connection, a short transform packet therefore reaches\ninit_smb2_rsp_hdr(), which interprets the request as a full SMB2 header\nand reads beyond the request allocation. The copied fields can then be\nreturned to the unauthenticated client.\n\nCompression transforms are converted to ordinary SMB2 messages before\nprotocol validation. After that conversion, validate ordinary SMB2\nrequests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption\ntransform requests to contain both a transform header and an SMB2\nheader. This rejects truncated requests before work allocation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server on TCP/445; the malformed short SMB2_TRANSFORM PDU is delivered entirely as remote network data in ksmbd_conn_handler_loop(), and the leaked bytes are returned in the network response. No local access is involved.\nAC:L - The attacker connects, sends a NEGOTIATE selecting dialect 2.1 (permitted by default since ksmbd_min_protocol() is SMB21_PROT), then a 35-byte packet with ProtocolId 0xFD\u0027SMB\u0027; the undersized-buffer header copy happens deterministically with no race, timing, or memory-layout dependency.\nPR:N - Only NEGOTIATE is required to reach the flaw, which precedes SESSION_SETUP; smb2_check_user_session() fails after the out-of-bounds copy has already been made, so the disclosure is delivered to a fully unauthenticated client.\nUI:N - The attacker drives the entire exchange from a single TCP connection; no action by any local user, administrator, or SMB client is needed.\nS:U - The out-of-bounds read and the disclosed data remain within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - init_smb2_rsp_hdr() reads a 64-byte smb2_hdr out of a ~40-byte kvmalloc allocation and echoes MessageId, ProcessId, TreeId, SessionId and 16 Signature bytes back to the client, disclosing ~28 bytes of uninitialized and adjacent kmalloc-64 heap contents per request, repeatable at will as a remote heap/KASLR oracle.\nI:N - The defect is a read past the request allocation; no attacker-controlled data is written into kernel memory and no kernel or filesystem state is modified by the truncated transform request.\nA:H - The header copy reads past the end of the slab object; on KASAN, hardware tag-based KASAN (MTE), or slub_debug/hardened builds this is a fatal report, and any such unchecked out-of-bounds kernel access is treated as crash-capable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T22:45:00.154Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b62c510f59803f82f9b4c76ead2a56833b2984c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfc0b8e5080aec87700774e8568765eaa4b7b92b"
        }
      ],
      "title": "ksmbd: validate minimum PDU size for transform requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68431",
    "datePublished": "2026-08-12T00:07:17.216Z",
    "dateReserved": "2026-07-30T09:28:09.393Z",
    "dateUpdated": "2026-08-13T22:45:00.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68431",
      "date": "2026-08-14",
      "epss": "0.00265",
      "percentile": "0.18392"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68431\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-12T00:17:43.180\",\"lastModified\":\"2026-08-13T23:17:37.363\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: validate minimum PDU size for transform requests\\n\\nThe receive path applies the minimum SMB2 PDU size check only when\\nProtocolId is SMB2_PROTO_NUMBER. A packet carrying\\nSMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated\\ndialect does not provide transform handling.\\n\\nOn an SMB 2.1 connection, a short transform packet therefore reaches\\ninit_smb2_rsp_hdr(), which interprets the request as a full SMB2 header\\nand reads beyond the request allocation. The copied fields can then be\\nreturned to the unauthenticated client.\\n\\nCompression transforms are converted to ordinary SMB2 messages before\\nprotocol validation. After that conversion, validate ordinary SMB2\\nrequests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption\\ntransform requests to contain both a transform header and an SMB2\\nheader. This rejects truncated requests before work allocation.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/connection.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"368ba06881c395f1c9a7ba22203cf8d78b4addc0\",\"lessThan\":\"b62c510f59803f82f9b4c76ead2a56833b2984c7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"368ba06881c395f1c9a7ba22203cf8d78b4addc0\",\"lessThan\":\"cfc0b8e5080aec87700774e8568765eaa4b7b92b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"df3a4518aee64f21bcafa891105b468413f27431\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"543c12c2644e772caa6880662c2a852cfdc5a10c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e9cb7be2fcbaee9e808b729e92948d38d52e5add\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.145\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.34\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.3.8\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/connection.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b62c510f59803f82f9b4c76ead2a56833b2984c7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cfc0b8e5080aec87700774e8568765eaa4b7b92b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:29:18+00:00",
      "cve": "CVE-2026-68431",
      "id": "CVE-2026-68431",
      "initial_release_date": "2026-08-12T00:00:00+00:00",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "199",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: validate minimum PDU size for transform requests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68431.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.