LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23093: ksmbd: smbd: fix dma_unmap_sg() nents

In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbd: fix dma_unmap_sg() nents The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-23093 is a Linux kernel ksmbd issue in DMA cleanup for SMB Direct/RDMA handling. The public record confirms a kernel fix but does not provide CVSS, impact details, or evidence of active exploitation. Treat it as an exposure-management item for systems running ksmbd rather than a confirmed emergency.

Executive priority

Prioritize normal kernel patch management unless ksmbd is internet-exposed or critical to file-service infrastructure. Escalate if vendors later assign high impact, publish stronger exploitation evidence, or confirm broader affected configurations.

Technical view

The flaw is a mismatch in ksmbd's SMB Direct path: dma_unmap_sg() should receive the same nents value passed to dma_map_sg(), not the mapped-count return value. The sources identify Linux kernel stable commits resolving the issue, but do not state resulting impact such as crash, memory corruption, or privilege escalation.

Likely exposure

Likely limited to Linux systems running affected kernels with ksmbd and SMB Direct/RDMA-related functionality present or enabled. The sources do not identify Samba user-space smbd as affected. Distribution exposure depends on vendor kernel packaging and backports.

Exploitation context

No active exploitation is supported by the supplied sources. The CVE is not marked KEV, and the bundle provides no public exploit status, attack prerequisites, or abuse reports. The practical risk cannot be rated confidently from the available evidence.

Researcher notes

Available evidence is sparse: no CVSS, CWE, impact statement, or exploit detail is supplied. Analysis should focus on the ksmbd SMB Direct DMA mapping/unmapping fix and compare downstream distribution patches against the listed kernel stable commits.

Mitigation direction

  • Check Linux distribution advisories for CVE-2026-23093 and apply fixed kernel updates.
  • Confirm deployed kernels include the referenced stable ksmbd fix commits or vendor backports.
  • Disable or restrict ksmbd where it is not operationally required.
  • Limit SMB service exposure to trusted networks pending vendor guidance.

Validation and detection

  • Inventory Linux hosts and identify kernels matching affected versions or vendor advisories.
  • Check whether ksmbd is installed, loaded, enabled, or exposed on each host.
  • Confirm patched systems contain the vendor fix or one of the referenced stable commits.
  • Review SMB/RDMA service exposure and network access controls.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23093 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
7Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0626e6641f6b467447c81dd7678a69c66f7746cf, 0626e6641f6b467447c81dd7678a69c66f7746cf, 0626e6641f6b467447c81dd7678a69c66f7746cf, 0626e6641f6b467447c81dd7678a69c66f7746cf, 0626e6641f6b467447c81dd7678a69c66f7746cf, 0626e6641f6b467447c81dd7678a69c66f7746cfunaffected
LinuxLinux5.15, 0, 5.15.199, 6.1.162, 6.6.123, 6.12.69, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.