CVE-2026-43185: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43185 Overview

CVE-2026-43185 is a signedness bug in the Linux kernel ksmbd SMB Direct (RDMA) implementation. The flaw resides in smb_direct_prepare_negotiation(), which casts unsigned __u32 values from sp->max_recv_size and req->preferred_send_size to a signed int before passing them to min_t(int, ...). A remote attacker who controls the SMB Direct negotiation can supply a preferred_send_size of 0x80000000, which is interpreted as a negative value and bypasses the size comparison. A subsequent message larger than the legitimate buffer triggers a heap buffer overflow in kernel memory.

Critical Impact
A remote attacker capable of negotiating an SMB Direct session against a ksmbd server can corrupt kernel heap memory, enabling potential kernel-level code execution or denial of service.

Affected Products

Linux kernel versions containing the ksmbd SMB server module prior to the patches referenced below
Distributions shipping ksmbd with SMB Direct (RDMA) support enabled
Stable kernel branches addressed by commits 55abc475, 6b4f875a, and ceae058e

Discovery Timeline

2026-05-06 - CVE-2026-43185 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43185

Vulnerability Analysis

The ksmbd kernel module implements an in-kernel SMB3 server, including SMB Direct over RDMA. During the SMB Direct negotiation, smb_direct_prepare_negotiation() evaluates the peer's advertised buffer sizes to determine the maximum receive size for subsequent messages. The function reduces max_recv_size against the peer's preferred_send_size using min_t(int, ...), which forces a signed comparison.

Because both source values are __u32, the cast to int reinterprets any value with the high bit set as negative. An attacker who sends preferred_send_size = 0x80000000 causes min_t to return that negative value, which is then stored as the allowed receive length. The next inbound payload exceeds the actual destination buffer, producing a heap overflow in non-paged kernel memory.

Root Cause

The root cause is an integer signedness error in input validation. Treating user-controlled __u32 fields as signed integers permits attacker-supplied values above 0x7FFFFFFF to defeat the boundary check. The upstream fix replaces min_t(int, ...) with min_t(u32, ...), preserving the unsigned domain throughout the comparison.

Attack Vector

Exploitation requires network reachability to the ksmbd SMB Direct listener and the ability to complete an RDMA connection. The attacker sends a crafted negotiation request with preferred_send_size = 0x80000000, then transmits a follow-up message larger than 1420 bytes. The oversized payload is copied into a kernel buffer sized using the corrupted length, overflowing adjacent heap structures. No authentication is required at the SMB Direct transport layer prior to negotiation completion, broadening the attacker pool.

No public proof-of-concept code is referenced in the advisory. Technical details are available in the upstream commits: Kernel Git Commit 55abc47, Kernel Git Commit 6b4f875, and Kernel Git Commit ceae058.

Detection Methods for CVE-2026-43185

Indicators of Compromise

Unexpected kernel oops, BUG, or KASAN reports referencing smb_direct_prepare_negotiation or ksmbd symbols
SMB Direct negotiation requests containing preferred_send_size values with the high bit set (≥ 0x80000000)
Inbound SMB Direct data messages exceeding the negotiated max_recv_size shortly after negotiation
Unexplained reboots or RDMA stack instability on hosts running ksmbd with RDMA enabled

Detection Strategies

Inspect kernel ring buffer (dmesg) for ksmbd warnings, RDMA completion errors, or memory corruption signatures following inbound SMB Direct sessions
Deploy network sensors that decode SMB Direct (port 5445/TCP and RoCE traffic) and alert on negotiation parameters with values larger than 0x7FFFFFFF
Audit running kernel versions across the fleet and flag hosts with ksmbd loaded but not patched to the fixed commits

Monitoring Recommendations

Forward kernel logs and auditd events from SMB-serving hosts to a centralized analytics platform for anomaly review
Track outbound connections initiated by SMB-serving hosts post-negotiation, which may indicate post-exploitation activity
Monitor lsmod output and module load events for unexpected loading of ksmbd on systems where it is not required

How to Mitigate CVE-2026-43185

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 55abc475, 6b4f875a, and ceae058e and reboot affected systems
Disable the ksmbd module on hosts that do not require an in-kernel SMB server using modprobe -r ksmbd and blacklist it
Restrict SMB Direct (port 5445/TCP and RDMA fabric access) to trusted management networks via firewall and RDMA partition keys

Patch Information

The fix replaces the signed min_t(int, ...) comparison with min_t(u32, ...) in smb_direct_prepare_negotiation(), ensuring the size negotiation operates entirely in the unsigned domain. The corrected logic is delivered in stable kernel commits 55abc475, 6b4f875a, and ceae058e. Distribution maintainers backport these commits to supported long-term kernel branches; consult vendor advisories for the exact package versions.

Workarounds

Unload ksmbd and rely on user-space SMB servers such as Samba where feasible until patches are deployed
Disable SMB Direct/RDMA transport in ksmbd configuration so negotiation paths exposing the bug are unreachable
Place SMB-serving hosts behind segmentation boundaries that block untrusted clients from reaching the SMB Direct listener

bash

# Configuration example: disable and blacklist ksmbd until patched
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/disable-ksmbd.conf
sudo update-initramfs -u

# Verify ksmbd is not loaded
lsmod | grep ksmbd || echo 'ksmbd not loaded'