ZDI-26-573: Linux Kernel KSMBD Response Header Out-Of-Bounds Read Information Disclosure Vulnerability
ZDI disclosed an unauthenticated out-of-bounds read (CVE-2026-68431) in Linux Kernel KSMBD causing sensitive information disclosure, CVSS 9.3.
The Zero Day Initiative published ZDI-26-573 describing an out-of-bounds read in the Linux Kernel KSMBD response header handling. Unauthenticated remote attackers can disclose sensitive information, but only systems with ksmbd enabled are affected. ZDI assigned a CVSS score of 9.3 and the identifier CVE-2026-68431.
- Unauthenticated info disclosure via KSMBD response headers
- Only systems with ksmbd enabled are vulnerable; CVSS 9.3
- CVEs
- CVE-2026-68431
- Products
- Linux Kernel
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68431 | Unauthenticated Out-of-Bounds Read in Linux Kernel ksmbd SMB Server | 9.1 | <1% |
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel KSMBD. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.