CVE-2026-68431: ksmbd: validate minimum PDU size for transform requests
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate minimum PDU size for transform requests
The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2PROTONUMBER. A packet carrying SMB2TRANSFORMPROTONUM bypasses the check even when the negotiated dialect does not provide transform handling.
On an SMB 2.1 connection, a short transform packet therefore reaches initsmb2rsphdr(), which interprets the request as a full SMB2 header and reads beyond the request allocation. The copied fields can then be returned to the unauthenticated client.
Compression transforms are converted to ordinary SMB2 messages before protocol validation. After that conversion, validate ordinary SMB2 requests against SMB2MINSUPPORTEDPDUSIZE and require encryption transform requests to contain both a transform header and an SMB2 header. This rejects truncated requests before work allocation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68431?
CVE-2026-68431 has a risk score of 45, indicating a medium-level severity.
How do I fix CVE-2026-68431?
To fix CVE-2026-68431, you should update to the latest version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-68431?
CVE-2026-68431 impacts systems running the Linux kernel that utilize ksmbd for SMB protocol handling.
What are the implications of CVE-2026-68431?
CVE-2026-68431 could allow an attacker to send specially crafted packets that bypass PDU size checks, potentially leading to data manipulation or denial of service.
Is CVE-2026-68431 being actively exploited?
As of the latest updates, there are no reports of active exploitation of CVE-2026-68431, but it is advisable to apply the patches promptly.