CVE-2026-89792: Linux Kernel ksmbd Out-of-Bounds Vulnerability

CVE-2026-89792 Overview

CVE-2026-89792 is an out-of-bounds read vulnerability in the Linux kernel's ksmbd in-kernel SMB server. The flaw exists in how ksmbd processes IPC share configuration responses. The kernel consumes variable-length fields from the share configuration payload without first validating the declared sizes. An attacker with local access and low privileges can trigger reads beyond the intended buffer boundaries, exposing kernel memory contents or crashing the system.

Critical Impact
Local attackers with low privileges can trigger out-of-bounds kernel memory reads in ksmbd, resulting in information disclosure or denial of service on affected Linux systems running the in-kernel SMB server.

Affected Products

Linux kernel versions containing the vulnerable ksmbd share configuration parsing logic
Systems using the in-kernel SMB3 server (ksmbd) for file sharing
Distributions that ship ksmbd prior to applying commits 61a8d066 and f25e9376

Discovery Timeline

2026-09-16 - CVE-2026-89792 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89792

Vulnerability Analysis

The ksmbd subsystem implements an SMB server directly in the Linux kernel. When a client accesses a share, ksmbd requests share configuration data through an IPC (inter-process communication) channel with a userspace helper. The response contains variable-length fields, including the share path and a veto list of file patterns.

The vulnerable code path consumes these variable-length fields without validating that the declared field sizes fit within the total payload length received. Parsing of the veto list is also unbounded, and the derivation of the path length fails to account for the separator byte between fields.

An attacker who can influence share configuration responses, or who can trigger share access with a crafted configuration, can cause the kernel to read past the end of the allocated payload buffer. The out-of-bounds read can leak adjacent kernel memory back into SMB responses or destabilize the kernel, producing a denial of service condition.

Root Cause

The root cause is missing input validation [CWE-125: Out-of-bounds Read] on trusted-looking IPC data. The share configuration handler in ksmbd accepts declared field lengths from the IPC response and reads them directly. There is no cross-check that offset plus length remains inside the payload buffer, no bound on veto list traversal, and an off-by-one error in the path length calculation that omits the separator byte.

Attack Vector

Exploitation requires local access with low privileges on a host running ksmbd. The attack surface is reached through the SMB IPC path used by ksmbd when servicing share access. An attacker able to send or influence share configuration responses can shape the payload so that the parser reads beyond the intended buffer during veto list processing or path extraction. Successful exploitation yields kernel information disclosure or a kernel-side crash, but the vulnerability does not permit direct modification of kernel state. Technical details are documented in the fix commits Kernel Git Commit 61a8d06 and Kernel Git Commit f25e937.

Detection Methods for CVE-2026-89792

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ksmbd, ksmbd_share_config, or veto list parsing routines in dmesg output
KASAN or SLUB debug reports flagging out-of-bounds reads inside ksmbd share configuration handlers
Anomalous or truncated SMB tree connect responses returned from ksmbd-backed shares

Detection Strategies

Audit installed kernel versions against distribution advisories referencing commits 61a8d06600c8c397f9a7e01940479d4c94a82f5f and f25e93768fcc5d8287e50b1ec52a42e4c276df34
Enable KASAN in test environments to surface out-of-bounds reads in the ksmbd code path during share configuration handling
Correlate SMB service crashes with concurrent share connection attempts from low-privileged local accounts

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized logging platform and alert on ksmbd faults
Track processes and users that trigger ksmbd_ipc_share_config_request activity through auditd rules on the IPC socket
Monitor for repeated SMB session failures from local users, which may indicate probing of the share configuration parser

How to Mitigate CVE-2026-89792

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 61a8d066 and f25e9376 as soon as vendor builds become available
Inventory all Linux hosts running ksmbd and prioritize patching of servers exposing SMB shares to multi-user environments
Restrict local shell access on ksmbd hosts to trusted administrators until patched kernels are deployed

Patch Information

The fix validates IPC share configuration payload sizes before consuming variable-length fields, bounds veto list parsing, and accounts for the separator byte when deriving the path length. See Kernel Git Commit 61a8d06 and Kernel Git Commit f25e937 for the upstream changes. Rebuild or upgrade to a distribution kernel that incorporates both commits.

Workarounds

Unload the ksmbd module (modprobe -r ksmbd) on hosts that do not require the in-kernel SMB server
Replace ksmbd with the userspace Samba smbd service where operationally feasible until patches are applied
Limit local user accounts on ksmbd hosts and enforce strict authentication on SMB shares to reduce the exploitable attack surface

bash

# Verify ksmbd module status and disable if not required
lsmod | grep ksmbd
systemctl stop ksmbd.service
systemctl disable ksmbd.service
modprobe -r ksmbd
echo 'blacklist ksmbd' | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf