Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use set info with opener credentials SMB2 SETINFO handlers invoke path-based VFS helpers after verifying the access mask granted to the SMB handle. These helpers perform their own ownership, inode permission, and LSM check...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. Currently, ksmbdclosefd marks the file as clos...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is a shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and then...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE FSCTLSETSPARSE in fsctlsetsparse modifies the file’s sparse attribute and saves it via xattr without any permission checks. This exposes two issue...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sameclienthaslease sameclienthaslease returns an opinfo pointer from ci-moplist after dropping ci-mlock without taking a reference. smbgrantoplock then dereferences that pointer in copylease and when...

ksmbd module Code Execution

The vulnerability in the ksmbd module of the SMB server implementation in Linux kernel is related to an integer overflow. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

ksmbd module Code Execution

The vulnerability in the ksmbd module of the SMB server implementation in Linux kernel is related to race conditions. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

KSMBDrain

Overview Proof-of-Concept exploit for KSMBDrain CVE-2025-38501. It can remotely exhaust the KSMBD server's connection limit. Details A remote attacker can exhaust a KSMBD server’s maximum connection limit by performing a TCP 3-way handshake and then not responding to further packets. By default,...

ksmbd-n-day

README This repo accompanies my research article Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days, in which I develop a POC for n-days from 2023: CVE-2023-52440 and CVE-2023-4130. I provide the kernel .config, a kernel run script, an image build script, and the POC. The...

KSMBD-CVE-2025-37947

CVE-2025-37947 PoC for ksmbd For more information, see the article here. Files bpf-tracer.sh - BPF msgmsg tracer CVE-2025-37947.c - exploit for CVE-2025-37947 proof-of-concept.c - minimal trigger that causes the OOB write ksmbd.conf - ksmbd config Makefile - builds exploit run-qemu.sh -...

ksmbrace

ksmbrace Vulnerability research in ksmbd , the Linux kernel's in-kernel SMB3 server fs/smb/server/. Authenticated-attacker flaws on the durable-handle and path-resolution paths of ksmbd. The name nods to the race-condition theme of this line of work see the withheld byte-range-lock UAF,...

CVE-2025-38561

CVE-2025-38561 ksmbd: PreauhHashValue race condition If client send multiple session setup requests to ksmbd, PreauhHashValue race condition could happen...

SMB-LINUX-CVE-2025-37899

Use-After-Free Vulnerability in Linux Kernel's ksmbd CVE-2025-37899 Description A use-after-free vulnerability has been discovered in the ksmbd module of the Linux kernel, responsible for implementing the SMB Server Message Block protocol for network file sharing. This vulnerability, identified a...

CVE-2026-99115

A flaw was found in the Linux kernel's ksmbd Server Message Block server. This flaw allows a remote attacker to cause an information disclosure by sending crafted compound requests. Because the server fails to properly initialize all response fields during filesystem information queries, unassign...

CVE-2026-99114

A flaw was found in the Linux kernel's ksmbd, an in-kernel Server Message Block SMB file server. This vulnerability allows an information disclosure where residual data from previous responses can be leaked to a client. A remote client can exploit this flaw by sending crafted compound requests,...

CVE-2026-99113

A flaw was found in the Linux kernel's ksmbd Server Message Block SMB file server. When handling compound file system query requests, the server fails to clear the response buffer before populating it. A remote client can exploit this vulnerability by sending specially crafted compound requests t...

CVE-2026-99114

In the Linux kernel, the following vulnerability has been resolved: ksmbd: initialize FileSystemControlFlags in FSCONTROLINFORMATION smb2getinfofilesystem reports 48 bytes for FSCONTROLINFORMATION, that is the whole of struct smb2fscontrolinfo, but never assigns FileSystemControlFlags. Those four...

CVE-2026-99113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in smb2getinfofilesystem reports 64 bytes for FSOBJECTIDINFORMATION, that is the whole of struct objectidinfo, but writes only 46 of them: - objid is 16 bytes, and wh...

CVE-2026-99115

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fill in FileSysIdentifier in FSPOSIXINFORMATION smb2getinfofilesystem reports 56 bytes for FSPOSIXINFORMATION, that is the whole of FILESYSTEMPOSIXINFO, but never assigns FileSysIdentifier. Those eight bytes go to the clie...

SUSE CVE-2026-99113

In the Linux kernel, the following vulnerability has been resolved: ksmbd: zero the FSOBJECTIDINFORMATION buffer before filling it in smb2getinfofilesystem reports 64 bytes for FSOBJECTIDINFORMATION, that is the whole of struct objectidinfo, but writes only 46 of them: - objid is 16 bytes, and wh...