KSMBD-CVE-2025-37947

CVE-2025-37947 PoC for ksmbd For more information, see the article here. Files bpf-tracer.sh - BPF msgmsg tracer CVE-2025-37947.c - exploit for CVE-2025-37947 proof-of-concept.c - minimal trigger that causes the OOB write ksmbd.conf - ksmbd config Makefile - builds exploit run-qemu.sh -...

ksmbrace

ksmbrace Vulnerability research in ksmbd , the Linux kernel's in-kernel SMB3 server fs/smb/server/. Authenticated-attacker flaws on the durable-handle and path-resolution paths of ksmbd. The name nods to the race-condition theme of this line of work see the withheld byte-range-lock UAF,...

ksmbd-n-day

README This repo accompanies my research article Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days, in which I develop a POC for n-days from 2023: CVE-2023-52440 and CVE-2023-4130. I provide the kernel .config, a kernel run script, an image build script, and the POC. The...

CVE-2025-38561

CVE-2025-38561 ksmbd: PreauhHashValue race condition If client send multiple session setup requests to ksmbd, PreauhHashValue race condition could happen...

SMB-LINUX-CVE-2025-37899

Use-After-Free Vulnerability in Linux Kernel's ksmbd CVE-2025-37899 Description A use-after-free vulnerability has been discovered in the ksmbd module of the Linux kernel, responsible for implementing the SMB Server Message Block protocol for network file sharing. This vulnerability, identified a...

KSMBDrain

Overview Proof-of-Concept exploit for KSMBDrain CVE-2025-38501. It can remotely exhaust the KSMBD server's connection limit. Details A remote attacker can exhaust a KSMBD server’s maximum connection limit by performing a TCP 3-way handshake and then not responding to further packets. By default,...

SUSE CVE-2026-99273

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smbstrtoUTF16 always writes a terminating zero UTF-16 unit after the converted characters, but getfilestreaminfo budgets only sizeofstruct smb2filestreaminfo + streaml...

CVE-2026-98901

A flaw was found in the Linux kernel's ksmbd module, an in-kernel Server Message Block SMB file sharing service. An authenticated remote client can cause a localized Denial of Service DoS or introduce file cache inconsistencies due to improper handling of lease break requests and acknowledgments...

UBUNTU-CVE-2026-99280

In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the...

UBUNTU-CVE-2026-99276

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer connection scavenging while session locks are busy The expiration worker holds connlistlock for reading while checking for authenticated sessions. Without this change, the check can wait for conn-sessionlock or...

UBUNTU-CVE-2026-99279

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reclaim ended sessions on logoff and expiration LOGOFF and previous-session replacement leave sessions Expired with a zero credential expiry. Ended sessions can retain their memory and connection slots when no further setu...

CVE-2026-99278

In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection. Reserve a...

UBUNTU-CVE-2026-99273

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smbstrtoUTF16 always writes a terminating zero UTF-16 unit after the converted characters, but getfilestreaminfo budgets only sizeofstruct smb2filestreaminfo + streaml...

UBUNTU-CVE-2026-99277

In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbdsessionunregister removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the sessi...

UBUNTU-CVE-2026-99278

In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection. Reserve a...

CVE-2026-99279

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reclaim ended sessions on logoff and expiration LOGOFF and previous-session replacement leave sessions Expired with a zero credential expiry. Ended sessions can retain their memory and connection slots when no further setu...

CVE-2026-99277

In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbdsessionunregister removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the sessi...

CVE-2026-99273

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smbstrtoUTF16 always writes a terminating zero UTF-16 unit after the converted characters, but getfilestreaminfo budgets only sizeofstruct smb2filestreaminfo + streaml...

CVE-2026-99276

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer connection scavenging while session locks are busy The expiration worker holds connlistlock for reading while checking for authenticated sessions. Without this change, the check can wait for conn-sessionlock or...

CVE-2026-99280

In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the...