ZDI-26-573: Linux Kernel KSMBD Response Header Out-Of-Bounds Read Information Disclosure Vulnerability

CVE-2026-68431 is an out-of-bounds read in the ksmbd in-kernel SMB server of the Linux kernel, rated 9.1 (critical) with a CVSS vector of high confidentiality and high availability impact over the network with no privileges or user interaction required. The receive path only enforces the minimum SMB2 PDU size when the packet's ProtocolId is SMB2_PROTO_NUMBER, so a packet marked as an SMB2 transform (SMB2_TRANSFORM_PROTO_NUM) skips the size check even when the negotiated dialect (e.g., SMB 2.1) provides no transform handling; the truncated request then reaches init_smb2_rsp_hdr(), which treats it as a full SMB2 header and reads past the end of the request allocation. An unauthenticated attacker with network access to an affected SMB service can send such a short transform packet and receive memory read beyond the allocation back in the response (information disclosure), and the critical CVSS score also reflects potential service-disruption impact. Any Linux system running the ksmbd SMB server and exposed over the network is affected; the source data specifies no affected or fixed version range. No public proof-of-concept or known in-the-wild exploitation exists (EPSS 0.4%, not in CISA KEV), though a Zero Day Initiative advisory (ZDI-26-573) documents the flaw.

Do: Upgrade to a kernel build containing the ksmd fix 'ksmbd: validate minimum PDU size for transform requests' — check your distribution's kernel security advisory, as no fixed version number was provided in the source data. Until patched, disable the ksmbd SMB server where it is not required and restrict SMB (port 445) to trusted networks with a firewall. Because the flaw is triggered on connections negotiated with dialects lacking transform handling (e.g., SMB 2.1), disabling legacy SMB 2.1 dialects may also reduce exposure.