CVE-2026-68083: Linux Kernel Path Traversal Vulnerability

CVE-2026-68083 Overview

CVE-2026-68083 is a path resolution flaw in the Linux kernel's ksmbd in-kernel SMB3 server. The create, mkdir, and hardlink sinks in ksmbd_vfs_kern_path_create() build an absolute path with convert_to_unix_name() and resolve it from AT_FDCWD via start_creating_path(). This bypasses the LOOKUP_BENEATH constraint used on the SMB2 open lookup. An authenticated remote client can race a missing path component so a .. segment is walked from the real filesystem root and escapes the exported share.

Critical Impact
An authenticated SMB client can escape the share root and create, modify, or hardlink files anywhere the ksmbd service can write, threatening file integrity and service availability across the host.

Affected Products

Linux kernel with the ksmbd SMB3 server module enabled
Distributions shipping kernels prior to the fixes referenced in the upstream stable commits
SMB shares exported through ksmbd to authenticated clients

Discovery Timeline

2026-08-10 - CVE-2026-68083 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68083

Vulnerability Analysis

The ksmbd module implements the SMB2/3 protocol inside the Linux kernel. The SMB2 open lookup is rooted at the share and enforces LOOKUP_BENEATH, which prevents path resolution from escaping the export root. The create, mkdir, and hardlink code paths do not share this rooting. ksmbd_vfs_kern_path_create() calls convert_to_unix_name() to build an absolute path, then resolves it from AT_FDCWD using start_creating_path(). As a result, a .. component in the request is walked against the real filesystem root instead of the share root.

Exploitation requires an authenticated session and abuses a race between the rooted lookup and the create walk. The rooted open lookup returns -ENOENT for a missing component, which drives control into the create branch. When the create walk then runs, the same component exists as a directory, and the walker resolves .. outside of the share. The attacker gains directory creation, file creation, or hardlink primitives outside the export boundary.

Root Cause

The root cause is inconsistent path-resolution rooting between SMB2 open and the create sink. Only the lookup and rename paths applied LOOKUP_BENEATH against share_conf->vfs_path. The create path built a shell-style absolute path and resolved it independently, so the sandbox that constrained reads did not constrain writes. This is a Time-of-Check Time-of-Use (TOCTOU) race combined with a Path Traversal weakness.

Attack Vector

A remote authenticated client issues SMB2 CREATE, MKDIR, or hardlink requests against a ksmbd share. The client crafts a path containing .. components and races the presence of an intermediate directory. The rooted lookup misses, the create walk succeeds, and traversal escapes the share. No user interaction is required. The upstream fix roots the create walk at the share by using vfs_path_parent_lookup(..., LOOKUP_BENEATH, &share_conf->vfs_path) and finalizes the target via start_creating_noperm(). The now-unused convert_to_unix_name() helper is removed. See the upstream stable commits 1c89519, 489d1de, 98185b3, and c7c884a.

Detection Methods for CVE-2026-68083

Indicators of Compromise

Files, directories, or hardlinks appearing outside the exported share root owned by the ksmbd service context.
SMB2 CREATE or MKDIR operations with path components containing .. sequences in ksmbd debug logs.
Repeated -ENOENT responses on SMB2 open immediately followed by successful CREATE operations targeting the same path.

Detection Strategies

Audit filesystem changes on hosts running ksmbd and correlate write events with SMB session identifiers, focusing on paths outside declared share roots.
Enable ksmbd verbose logging and monitor for CREATE, MKDIR, and hardlink calls that contain parent-directory traversal tokens.
Track kernel version banners across the Linux estate to identify hosts running unpatched ksmbd builds.

Monitoring Recommendations

Ingest auditd PATH and SYSCALL records for the ksmbd process into a centralized log platform and alert on writes outside expected share directories.
Baseline SMB share write patterns per client and alert on new paths that resolve above share roots.
Alert on the appearance of unexpected hardlinks whose target inode resides outside the exported directory tree.

How to Mitigate CVE-2026-68083

Immediate Actions Required

Update the Linux kernel to a stable release that contains the referenced upstream fixes for ksmbd_vfs_kern_path_create().
Restrict ksmbd share access to trusted authenticated users until patches are deployed, since exploitation requires valid credentials.
Disable the ksmbd module on hosts that do not require an in-kernel SMB server, using modprobe -r ksmbd and blacklisting the module.

Patch Information

Upstream fixes are available in the stable tree in commits 1c89519, 489d1de, 98185b3, and c7c884a. The patches root the create walk at the share using vfs_path_parent_lookup() with LOOKUP_BENEATH and finalize the target with start_creating_noperm(). Rebuild the kernel or install a distribution kernel containing these commits, then reboot the affected hosts.

Workarounds

Replace ksmbd with a userspace SMB server such as Samba on affected hosts until the kernel is patched.
Block inbound SMB traffic (TCP/445) at network boundaries and internal firewalls where SMB service is not required.
Reduce blast radius by exporting shares from filesystems that contain no data outside the intended share path, for example a dedicated mount point.

bash

# Temporary mitigation: unload and blacklist ksmbd
sudo systemctl stop ksmbd.service
sudo modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/ksmbd-blacklist.conf

# Verify running kernel does not expose ksmbd
lsmod | grep ksmbd
ss -tlnp | grep ':445'