LiveActive security incident?Get immediate response
CVE Record

CVE-2026-68431: ksmbd: validate minimum PDU size for transform requests

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2_PROTO_NUMBER. A packet carrying SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated dialect does not provide transform handling. On an SMB 2.1 connection, a short transform packet therefore reaches init_smb2_rsp_hdr(), which interprets the request as a full SMB2 header and reads beyond the request allocation. The copied fields can then be returned to the unauthenticated client. Compression transforms are converted to ordinary SMB2 messages before protocol validation. After that conversion, validate ordinary SMB2 requests against SMB2_MIN_SUPPORTED_PDU_SIZE and require encryption transform requests to contain both a transform header and an SMB2 header. This rejects truncated requests before work allocation.

CriticalCVSS 9.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

CVE-2026-68431 is a critical Linux ksmbd flaw. An unauthenticated network client can send a truncated SMB transform request that causes the kernel SMB server to read beyond the request buffer. Data copied from that unintended memory may be returned to the client. Availability impact is rated high, although the supplied description does not explain the precise failure mode.

Executive priority

Treat reachable ksmbd servers as an urgent patching priority because exploitation requires no account or user action and may disclose kernel-adjacent memory. Prioritize externally reachable and broadly accessible file servers first. Systems not using ksmbd are not shown as exposed by the supplied evidence. Require vendor confirmation where kernel versions are backported or customized.

Technical view

The ksmbd receive path checked minimum size only for ordinary SMB2 protocol identifiers. A transform identifier could bypass validation on an SMB 2.1 connection and reach init_smb2_rsp_hdr(), which treats the short allocation as a full header and reads out of bounds. The referenced fix validates converted compression messages and requires encryption requests to contain both transform and SMB2 headers.

Likely exposure

Likely exposure is limited to Linux systems running ksmbd and accepting reachable SMB connections. The vulnerable path is specifically described on SMB 2.1 connections. Internet-facing or broadly accessible SMB services have the greatest practical exposure. The supplied version data mixes release numbers and commit identifiers, so distribution or appliance package status must be confirmed with its vendor.

Exploitation context

The path is network-accessible, low-complexity, requires no privileges or user interaction, and can be reached before authentication. The CVSS score is 9.1, with high confidentiality and availability impacts. The source bundle marks KEV false and provides no evidence of active exploitation or a public exploit; absence from KEV does not establish that exploitation is impossible.

Researcher notes

No CWE is supplied. The version records contain commit hashes, duplicate entries, a value of “0,” and release strings that are unsafe to interpret as simple ranges. Validate exposure through source or vendor backport provenance. The description establishes an out-of-bounds read and possible response disclosure; it does not establish code execution, and no active exploitation evidence is provided.

Mitigation direction

  • Obtain a vendor kernel update incorporating the applicable referenced Linux stable fix.
  • Confirm the exact fixed package or backport with the distribution or appliance vendor.
  • Until updated, restrict SMB access to trusted networks and authorized clients where operationally feasible.
  • If ksmbd is unnecessary, follow vendor guidance before disabling it temporarily.

Validation and detection

  • Inventory systems running ksmbd, their kernel builds, distribution packages, and accepted SMB dialects.
  • Map each deployed package to the referenced stable fixes using authoritative vendor guidance.
  • Verify network controls prevent untrusted clients from reaching exposed SMB services.
  • After updating, confirm the running kernel contains the vendor's applicable backport or stable fix.
  • Avoid validating with malformed production traffic; use package and source provenance instead.
Prepared
Confidence
high
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-68431 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.1CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.1Critical
CVSS 3.1 vector shape for CVE-2026-68431Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxdf3a4518aee64f21bcafa891105b468413f27431, 543c12c2644e772caa6880662c2a852cfdc5a10c, 368ba06881c395f1c9a7ba22203cf8d78b4addc0, 368ba06881c395f1c9a7ba22203cf8d78b4addc0, 368ba06881c395f1c9a7ba22203cf8d78b4addc0, 368ba06881c395f1c9a7ba22203cf8d78b4addc0, 368ba06881c395f1c9a7ba22203cf8d78b4addc0, e9cb7be2fcbaee9e808b729e92948d38d52e5add, 5.15.145, 6.1.34, 6.3.8unaffected
LinuxLinux6.4, 0, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.6, 7.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.