Security readout for executives and security teams
Plain-English summary
A remotely reachable flaw in Linux's ksmbd SMB server miscalculates an extended-attribute name buffer by one byte. The supplied CVSS assessment indicates possible unauthorized disclosure without authentication or user interaction. Systems are exposed only when they run an affected kernel and use ksmbd on an attacker-reachable network.
Executive priority
Treat as a high-priority patching item for internet-facing or broadly reachable ksmbd servers. Accelerate inventory and compensating controls because authentication is not required under the supplied CVSS assessment. Lower the priority for hosts that do not use ksmbd, while still confirming distributor package status.
Technical view
The smb2_set_ea validation omitted the required null terminator when calculating the EA name's buffer length. The correction adds one byte to EaNameLength where termination is expected. The supplied record rates this CVSS 3.1 score 7.5 with network access, low complexity, no privileges, no interaction, and high confidentiality impact.
Likely exposure
Prioritize Linux hosts running an affected kernel where ksmbd is enabled and SMB is reachable from untrusted networks. The supplied status data identifies affected releases and commit identifiers, but package-level exposure may differ because distributors commonly backport kernel fixes.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. Its CVSS vector nevertheless describes unauthenticated network reachability and low attack complexity. The exact disclosure mechanism and practical reliability are not established by the provided sources.
Researcher notes
The documented defect is an off-by-one validation error at an EA name boundary: validation excluded the null terminator expected in the input buffer. The sources establish the corrected calculation but do not identify a CWE, demonstrate exploitation, or fully explain how the stated high-confidentiality impact is achieved.
Mitigation direction
- Apply a vendor-supported kernel update incorporating the applicable cited stable fix.
- Consult the Linux distributor's advisory to map backported fixes to installed package versions.
- Disable ksmbd where it is not operationally required.
- Restrict SMB access to trusted networks until remediation is confirmed.
Validation and detection
- Inventory kernel builds on systems that provide SMB through ksmbd.
- Confirm whether ksmbd is enabled and reachable from untrusted network segments.
- Check vendor package changelogs for CVE-2025-68806 or an applicable cited fix commit.
- Verify the updated kernel is running after installation and reboot.
- Reassess SMB exposure after remediation without sending malformed traffic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68806 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/cae52c592a07e1d3fa3338a5f064a374a5f26750CVE reference, Linux
- https://git.kernel.org/stable/c/a28a375a5439eb474e9f284509a407efb479c925CVE reference, Linux
- https://git.kernel.org/stable/c/d26af6d14da43ab92d07bc60437c62901dc522e6CVE reference, Linux
- https://git.kernel.org/stable/c/6dc8cf6e7998ef7aeb9383a4c2904ea5d22fa2e4CVE reference, Linux
- https://git.kernel.org/stable/c/95d7a890e4b03e198836d49d699408fd1867cb55CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.