CVE-2026-68431: Linux Kernel Information Disclosure Bug

CVE-2026-68431 Overview

CVE-2026-68431 is a Linux kernel vulnerability in the ksmbd in-kernel Server Message Block (SMB) server. The flaw exists in the receive path, which applies the minimum SMB2 protocol data unit (PDU) size check only when ProtocolId equals SMB2_PROTO_NUMBER. Packets carrying SMB2_TRANSFORM_PROTO_NUM bypass this validation, even when the negotiated dialect does not support transform handling. An unauthenticated remote client can send a short transform packet on an SMB 2.1 connection, causing init_smb2_rsp_hdr() to read beyond the request allocation and return the copied fields to the client.

Critical Impact
Unauthenticated remote attackers can trigger out-of-bounds reads in the Linux kernel and receive leaked kernel memory contents through crafted SMB transform packets.

Affected Products

Linux kernel ksmbd SMB server module
Systems exposing ksmbd over SMB 2.1 connections
Unpatched kernel branches prior to the fix commits b62c510f5980 and cfc0b8e5080a

Discovery Timeline

2026-08-12 - CVE CVE-2026-68431 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68431

Vulnerability Analysis

The ksmbd kernel module implements SMB2/3 protocol handling directly in kernel space. The receive path validates that inbound requests meet a minimum PDU size defined by SMB2_MIN_SUPPORTED_PDU_SIZE. This check gates access to init_smb2_rsp_hdr(), which parses request fields to build the response header.

The validation guard only executes when the packet's ProtocolId field is SMB2_PROTO_NUMBER (0xFE 'S' 'M' 'B'). Transform packets identified by SMB2_TRANSFORM_PROTO_NUM (0xFD 'S' 'M' 'B') skip the length check entirely. Transform packets are normally used to carry encrypted SMB3 payloads, but the check omission allows them to reach downstream parsing even when the negotiated dialect is SMB 2.1, which has no transform handling.

A short transform packet reaches init_smb2_rsp_hdr(), which interprets the buffer as a full SMB2 header and reads beyond the allocated request buffer. The out-of-bounds data is copied into the response header and returned to the unauthenticated client.

Root Cause

The root cause is an incomplete input validation check that treats the two SMB protocol identifiers asymmetrically. Transform packets bypass the minimum PDU size gate, allowing truncated requests to reach code paths that assume a fully populated SMB2 header layout.

Attack Vector

An unauthenticated remote attacker with network reachability to a ksmbd service establishes an SMB 2.1 connection and sends a crafted packet with the transform protocol identifier and a payload shorter than a full SMB2 header. The kernel parses the truncated packet as a valid SMB2 request, reading adjacent kernel memory that is subsequently returned in the response. The corrected code path validates ordinary SMB2 requests against SMB2_MIN_SUPPORTED_PDU_SIZE and requires encryption transform requests to contain both a transform header and an SMB2 header before work allocation proceeds.

No public proof-of-concept code is available. See the kernel commit b62c510f5980 and kernel commit cfc0b8e5080a for the upstream fix.

Detection Methods for CVE-2026-68431

Indicators of Compromise

Inbound SMB packets with ProtocolId set to 0xFD 'S' 'M' 'B' (SMB2_TRANSFORM_PROTO_NUM) whose total length is less than the sum of the transform header and a minimum SMB2 header.
SMB 2.1 sessions receiving transform-tagged packets, which should not occur because SMB 2.1 does not negotiate encryption transforms.
Anomalous ksmbd response frames containing entropy consistent with uninitialized kernel memory in header fields.

Detection Strategies

Deploy network intrusion detection signatures that flag SMB packets with transform protocol identifiers on connections negotiated to dialects below 3.0.
Enable ksmbd audit logging where available and correlate short-request rejections after applying the patch to identify prior scanning attempts.
Monitor kernel logs for ksmbd warnings or errors around request length validation.

Monitoring Recommendations

Track SMB traffic volume and packet-size distributions to the ksmbd service, alerting on bursts of undersized packets from a single source.
Log all SMB dialect negotiations and flag mismatches between negotiated dialect and subsequent transform-protocol packets.
Restrict SMB exposure at the network perimeter and monitor firewall logs for TCP/445 traffic from untrusted sources.

How to Mitigate CVE-2026-68431

Immediate Actions Required

Apply the upstream Linux kernel patches from commits b62c510f59803f82f9b4c76ead2a56833b2984c7 and cfc0b8e5080aec87700774e8568765eaa4b7b92b to any host running ksmbd.
Update to a distribution kernel that includes the ksmbd transform PDU validation fix.
Restrict inbound SMB (TCP/445) access to trusted management networks until patching is complete.

Patch Information

The fix validates ordinary SMB2 requests against SMB2_MIN_SUPPORTED_PDU_SIZE after compression transforms are converted, and requires encryption transform requests to contain both a transform header and an SMB2 header. Truncated requests are rejected before work allocation. Reference the upstream fix in commit b62c510f5980 and the companion commit cfc0b8e5080a.

Workarounds

Disable the ksmbd kernel module on hosts that do not require an in-kernel SMB server and fall back to userspace Samba where feasible.
Enforce host-based firewall rules that block SMB traffic from untrusted network segments.
Where ksmbd must remain enabled, require authenticated VPN access before permitting SMB connectivity.

bash

# Disable and unload the ksmbd module until a patched kernel is deployed
sudo systemctl stop ksmbd.service
sudo systemctl disable ksmbd.service
sudo modprobe -r ksmbd

# Block SMB access at the host firewall (nftables example)
sudo nft add rule inet filter input tcp dport 445 drop