CVE-2026-68431 in Linux
Summary
by MITRE • 08/12/2026
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate minimum PDU size for transform requests
The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2_PROTO_NUMBER. A packet carrying SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated dialect does not provide transform handling.
On an SMB 2.1 connection, a short transform packet therefore reaches init_smb2_rsp_hdr(), which interprets the request as a full SMB2 header and reads beyond the request allocation. The copied fields can then be returned to the unauthenticated client.
Compression transforms are converted to ordinary SMB2 messages before protocol validation. After that conversion, validate ordinary SMB2 requests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption transform requests to contain both a transform header and an SMB2 header. This rejects truncated requests before work allocation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists in the ksmbd implementation within the Linux kernel's SMB2 protocol handling subsystem where insufficient validation occurs for transform requests. The flaw stems from a logic error in the packet processing flow where the minimum PDU size check is only applied when the ProtocolId equals SMB2_PROTO_NUMBER, but bypasses validation for packets using SMB2_TRANSFORM_PROTO_NUM even when the negotiated dialect does not support transform handling. This creates a scenario where maliciously crafted short transform packets can traverse the receive path without proper validation, ultimately reaching the init_smb2_rsp_hdr() function which treats these malformed packets as full SMB2 headers and attempts to read beyond the allocated buffer space.
The technical execution of this vulnerability occurs specifically on SMB 2.1 connections where a truncated transform packet can successfully bypass initial validation checks. When such a packet reaches the init_smb2_rsp_hdr() function, it interprets the incomplete data structure as a complete SMB2 header and proceeds to read memory beyond the allocated request buffer, potentially exposing sensitive information from kernel memory. This memory disclosure vulnerability arises because the system reads fields from what it believes is a complete SMB2 header but contains insufficient data, leading to unpredictable behavior and potential information leakage. The issue demonstrates a classic buffer over-read condition that falls under CWE-129 and CWE-787 categories, representing improper input validation and out-of-bounds memory access respectively.
The operational impact of this vulnerability extends beyond simple information disclosure, as it represents a fundamental flaw in the protocol validation mechanism that could potentially be exploited for more sophisticated attacks. An attacker could leverage this vulnerability to gain insights into kernel memory layout, potentially aiding in the development of more advanced exploits targeting the SMB2 implementation. The vulnerability affects systems running ksmbd servers that accept SMB 2.1 connections and have transform capabilities enabled, making it particularly concerning for enterprise environments where SMB services are commonly deployed. This flaw aligns with ATT&CK technique T1059.007 for operating system command injection and could be used in conjunction with other techniques to escalate privileges or gain unauthorized access to network resources.
The mitigation strategy involves implementing proper validation checks that occur before any processing begins, ensuring that compression transforms are converted to standard SMB2 messages during the protocol validation phase rather than after. This approach requires that ordinary SMB2 requests be validated against SMB2_MIN_SUPPORTED_PDU_SIZE before any work allocation occurs, while encryption transform requests must contain both a valid transform header and an SMB2 header structure. This dual-validation mechanism prevents truncated requests from reaching vulnerable functions within the kernel and effectively closes the attack vector by ensuring all requests undergo proper size validation regardless of their protocol identifier or transformation status. The fix essentially implements a layered security approach where protocol validation occurs before data processing, preventing the exploitation of memory access violations that could lead to privilege escalation or information disclosure attacks.