CVE-2026-23093: Linux Kernel ksmbd DMA Mapping Vulnerability

CVE-2026-23093 Overview

A vulnerability has been identified and resolved in the Linux kernel's ksmbd (kernel SMB server) module. The issue relates to incorrect handling of DMA (Direct Memory Access) scatter-gather list operations in the SMB Direct (SMBD) implementation. Specifically, the dma_unmap_sg() function was being called with an incorrect number of entries (nents), using the return value from dma_map_sg() instead of the original nents value that was passed to the mapping function.

Critical Impact

This memory management flaw in the kernel's SMB server implementation could lead to memory corruption, system instability, or potential denial of service conditions when handling SMB Direct connections.

Affected Products

• Linux kernel with ksmbd module enabled
• Systems using SMB Direct (SMBD) functionality
• Kernel versions prior to the security patches

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-23093 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-23093

Vulnerability Analysis

This vulnerability exists in the ksmbd subsystem of the Linux kernel, which provides in-kernel SMB3 server functionality. The flaw occurs in the SMB Direct (SMBD) component, which handles RDMA (Remote Direct Memory Access) operations for high-performance SMB connections.

The DMA API in the Linux kernel requires careful management of scatter-gather lists. When dma_map_sg() is called, it may coalesce multiple scatter-gather entries, returning a potentially smaller number than was originally passed. However, when unmapping, dma_unmap_sg() must be called with the original number of entries, not the coalesced count returned by the mapping function. The ksmbd SMBD code was incorrectly using the return value from dma_map_sg() when calling dma_unmap_sg(), violating the DMA API contract.

Root Cause

The root cause is a misunderstanding of the Linux DMA API semantics. The dma_map_sg() function returns the number of DMA-mapped segments after potential coalescing, which can be less than the original nents parameter. However, dma_unmap_sg() expects the original nents value to properly unmap all memory regions. Using the wrong value leads to incomplete unmapping operations, which can result in memory leaks, corruption of DMA mappings, or kernel memory management issues.

Attack Vector

While the attack vector is not fully documented, this vulnerability could potentially be triggered by:

1. An attacker with network access to a system running ksmbd with SMB Direct enabled
2. Sending specially crafted SMB3 RDMA requests that exercise the vulnerable code path
3. Repeatedly triggering the incorrect DMA unmap operations to cause memory exhaustion or corruption

The vulnerability affects the kernel's memory management subsystem, which could lead to system instability or create conditions exploitable for further attacks.

Detection Methods for CVE-2026-23093

Indicators of Compromise

• Unexpected kernel warnings or errors related to DMA operations in system logs
• Memory corruption indicators or kernel panics when using SMB Direct functionality
• Abnormal memory usage patterns on systems running ksmbd with RDMA enabled

Detection Strategies

• Monitor kernel logs for DMA-related warnings or errors from the ksmbd module
• Use kernel debugging tools to detect DMA API violations
• Implement system monitoring for unexpected ksmbd crashes or restarts

Monitoring Recommendations

• Enable kernel DMA debugging (CONFIG_DMA_API_DEBUG) in development environments
• Monitor system memory usage for anomalies when ksmbd SMBD is active
• Review kernel logs regularly for ksmbd-related error messages

How to Mitigate CVE-2026-23093

Immediate Actions Required

• Update to a patched Linux kernel version containing the fix
• If immediate patching is not possible, consider disabling SMB Direct (SMBD) functionality in ksmbd
• Monitor systems running ksmbd for any signs of exploitation or instability

Patch Information

The vulnerability has been resolved through kernel patches that correct the dma_unmap_sg() call to use the original nents value. The fixes are available in the following commits:

• Kernel Git Commit 98e3e2b5
• Kernel Git Commit d1943bc9

Administrators should update to kernel versions containing these patches through their distribution's package management system.

Workarounds

• Disable ksmbd if not required, or use userspace Samba instead
• Disable SMB Direct functionality by not loading RDMA-related kernel modules
• Restrict network access to SMB services to trusted networks only
• Consider using firewall rules to limit access to SMB ports (445/TCP)