KSMBD-CVE-2025-37947

CVE-2025-37947 PoC for ksmbd For more information, see the article here. Files bpf-tracer.sh - BPF msgmsg tracer CVE-2025-37947.c - exploit for CVE-2025-37947 proof-of-concept.c - minimal trigger that causes the OOB write ksmbd.conf - ksmbd config Makefile - builds exploit run-qemu.sh -...

ksmbd-n-day

README This repo accompanies my research article Eternal-Tux: Crafting a Linux Kernel KSMBD 0-Click RCE Exploit from N-Days, in which I develop a POC for n-days from 2023: CVE-2023-52440 and CVE-2023-4130. I provide the kernel .config, a kernel run script, an image build script, and the POC. The...

CVE-2025-38561

CVE-2025-38561 ksmbd: PreauhHashValue race condition If client send multiple session setup requests to ksmbd, PreauhHashValue race condition could happen...

SMB-LINUX-CVE-2025-37899

Use-After-Free Vulnerability in Linux Kernel's ksmbd CVE-2025-37899 Description A use-after-free vulnerability has been discovered in the ksmbd module of the Linux kernel, responsible for implementing the SMB Server Message Block protocol for network file sharing. This vulnerability, identified a...

CVE-2026-90169

A flaw was found in ksmbd within the Linux kernel. A remote attacker could exploit this vulnerability by initiating an SMB3.1.1 multichannel binding connection and then disconnecting after the NTLM negotiate request but before the authenticate request. This failure to properly free...

CVE-2026-90167

A flaw was found in ksmbd, the in-kernel SMB server for Linux. A race condition exists during the handling of oplock opportunistic locking close operations. This can allow a new oplock break owner to incorrectly overwrite internal state, leading to unexpected behavior or a denial of service. This...

CVE-2026-90156

A flaw was found in ksmbd, a component of the Linux kernel. When handling deferred locks, a failure in setting up asynchronous work can lead to a null pointer dereference and the continued linking of a freed file lock. This memory corruption issue can cause a system crash, resulting in a denial o...

CVE-2026-90153

A flaw was found in ksmbd, the in-kernel SMB3 server for Linux. The smbcheckpermdacl function incorrectly validates Access Control Entry ACE walks by using the remaining security descriptor length instead of the declared Discretionary Access Control List DACL size. This allows a remote attacker t...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23364)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp with the correct function, cryptomemneq. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31704)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use checkaddoverflow to prevent u16 DACL size overflow setposixaclentriesdacl and setntacldacl accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causin...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31612)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate EaNameLength in smb2getea smb2getea reads eareq-EaNameLength from the client request and passes it directly to strncmp as the comparison length without verifying that the length of the name really is the size of t...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31705)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2getea EA alignment smb2getea applies 4-byte alignment padding via memset after writing each EA entry. The bounds check on buffreelen is performed before the value memcpy, but the alignment...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53198)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred filelock on double SMB2CANCEL A deferred byte-range lock an SMB2LOCK that blocks registers an async work on conn-asyncrequests via setupasyncwork, with cancelfn = smb2removeblockedlock and...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31611)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require 3 sub-authorities before reading subauth2 parsedacl compares each ACE SID against sidunixNFSmode and on match reads sid.subauth2 as the file mode. If sidunixNFSmode is the prefix S-1-5-88-3 with numsubauth = 2 then...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31711)

"In the Linux kernel, the following vulnerability has been resolved: smb: server: fix activenumconn leak on transport allocation failure Commit 77ffbcac4e56 'smb: server: fix leak of activenumconn in ksmbdtcpnewconnection' addressed the kthreadrun failure path. The earlier alloctransport == NULL...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31712)

"In the Linux kernel, the following vulnerability has been resolved: ksmbd: require minimum ACE size in smbcheckpermdacl Both ACE-walk loops in smbcheckpermdacl only guard against an under-sized remaining buffer, not against an ACE whose declared ace-size is smaller than the struct it claims to...

ksmbrace

ksmbrace Vulnerability research in ksmbd , the Linux kernel's in-kernel SMB3 server fs/smb/server/. Authenticated-attacker flaws on the durable-handle and path-resolution paths of ksmbd. The name nods to the race-condition theme of this line of work see the withheld byte-range-lock UAF,...

CVE-2026-98439

A flaw was found in the Linux kernel's Server Message Block SMB server, ksmbd. When a connection is closed while an asynchronous request is still waiting, the server fails to cancel active requests before waiting for them to complete. A remote client could exploit this flaw to prevent the...

KSMBDrain

Overview Proof-of-Concept exploit for KSMBDrain CVE-2025-38501. It can remotely exhaust the KSMBD server's connection limit. Details A remote attacker can exhaust a KSMBD server’s maximum connection limit by performing a TCP 3-way handshake and then not responding to further packets. By default,...

CVE-2026-98454

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2parsecontexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes...