GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68457 (GCVE-0-2026-68457)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-18 06:56
VLAI
Title
ksmbd: use opener credentials for FSCTL mutations
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers can revalidate inode permissions, ownership and LSM policy independently of the SMB handle access mask. Run each operation with the credentials captured in the target file when the handle was opened. Keep credential handling local to these single-file FSCTLs rather than applying session credentials to the complete IOCTL handler, which also contains handle-less and multi-handle operations.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < a8c18434e1f0d9f7989170bdb0490c0160baf065 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < 1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < fb1cae6302d58414ddf029e3f642711bd30243f7 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < e205f3e7e8c31a47cd11efb6cf663a527177e432 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < cfb2c6f71d61ed807c9d7a7af331d406f1f31877 (git)
Affected: e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 , < c6394bcaf254c5baf9aff43376020be5db6d3316 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a8c18434e1f0d9f7989170bdb0490c0160baf065",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "fb1cae6302d58414ddf029e3f642711bd30243f7",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "e205f3e7e8c31a47cd11efb6cf663a527177e432",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "cfb2c6f71d61ed807c9d7a7af331d406f1f31877",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "c6394bcaf254c5baf9aff43376020be5db6d3316",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c",
            "fs/smb/server/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for FSCTL mutations\n\nSET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB\nhandle but call VFS xattr, fallocate or fileattr helpers with the current\nksmbd worker credentials. Those helpers can revalidate inode permissions,\nownership and LSM policy independently of the SMB handle access mask.\n\nRun each operation with the credentials captured in the target file when\nthe handle was opened. Keep credential handling local to these single-file\nFSCTLs rather than applying session credentials to the complete IOCTL\nhandler, which also contains handle-less and multi-handle operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in ksmbd\u0027s SMB2 IOCTL handler, reachable remotely over TCP/445 (or SMB Direct) via smb2_ioctl() processing FSCTL_SET_SPARSE, FSCTL_SET_ZERO_DATA, and FSCTL_SET_COMPRESSION after SMB2 session setup and tree connect.\nAC:L - An attacker deterministically opens a target file handle and sends the FSCTL; smb2_ioctl() never calls ksmbd_override_fsids(), so VFS helpers always run with privileged worker credentials instead of filp-\u003ef_cred, making the bypass reliable without races or external timing.\nPR:N - Although a valid SMB session, writable tree, and handle with FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES are required, ksmbd supports passwordless guest sessions on guest-writable shares, so exploitation does not require prior host privileges in a reasonable deployment.\nUI:N - The attacker directly issues SMB2 IOCTL requests against handles it opened; no separate victim action such as mounting a share, opening a file, or clicking a prompt is required beyond network access to ksmbd.\nS:U - The credential bypass permits unauthorized file metadata and content mutations within the same host kernel and exported filesystem security authority; it does not cross VM, container, IOMMU, or comparable isolation boundaries.\nC:N - These FSCTLs only mutate sparse/compression xattrs or zero/punch file ranges via vfs_fallocate and vfs_fileattr helpers; they provide no read primitive, kernel memory disclosure, or alternate unauthorized data exfiltration path.\nI:H - Privileged ksmbd worker credentials bypass opener UID, group, capability, inode, and LSM revalidation in vfs_fallocate, vfs_fileattr_set, and ksmbd_vfs_set_dos_attrib_xattr, enabling unauthorized sparse/compression attribute changes and arbitrary-range zeroing or hole-punching of protected files.\nA:H - Repeated FSCTL_SET_ZERO_DATA requests can persistently destroy or corrupt critical exported files and dependent services by zeroing or punching arbitrary ranges with root-equivalent credentials, causing sustained loss of share data and service availability until restoration."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:56:05.565Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a8c18434e1f0d9f7989170bdb0490c0160baf065"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb1cae6302d58414ddf029e3f642711bd30243f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e205f3e7e8c31a47cd11efb6cf663a527177e432"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfb2c6f71d61ed807c9d7a7af331d406f1f31877"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6394bcaf254c5baf9aff43376020be5db6d3316"
        }
      ],
      "title": "ksmbd: use opener credentials for FSCTL mutations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68457",
    "datePublished": "2026-08-15T05:51:18.233Z",
    "dateReserved": "2026-07-30T09:28:09.395Z",
    "dateUpdated": "2026-08-18T06:56:05.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68457",
      "date": "2026-09-04",
      "epss": "0.00479",
      "percentile": "0.39591"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:43:34.000Z",
      "cve": "CVE-2026-68457",
      "id": "msrc_CVE-2026-68457",
      "initial_release_date": "2026-08-23T14:43:34.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ksmbd: use opener credentials for FSCTL mutations",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-68457.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68457\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:17:48.460\",\"lastModified\":\"2026-08-18T07:16:52.283\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nksmbd: use opener credentials for FSCTL mutations\\n\\nSET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB\\nhandle but call VFS xattr, fallocate or fileattr helpers with the current\\nksmbd worker credentials. Those helpers can revalidate inode permissions,\\nownership and LSM policy independently of the SMB handle access mask.\\n\\nRun each operation with the credentials captured in the target file when\\nthe handle was opened. Keep credential handling local to these single-file\\nFSCTLs rather than applying session credentials to the complete IOCTL\\nhandler, which also contains handle-less and multi-handle operations.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\",\"fs/smb/server/vfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"a8c18434e1f0d9f7989170bdb0490c0160baf065\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"fb1cae6302d58414ddf029e3f642711bd30243f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"e205f3e7e8c31a47cd11efb6cf663a527177e432\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"cfb2c6f71d61ed807c9d7a7af331d406f1f31877\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9\",\"lessThan\":\"c6394bcaf254c5baf9aff43376020be5db6d3316\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/smb/server/smb2pdu.c\",\"fs/smb/server/vfs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a8c18434e1f0d9f7989170bdb0490c0160baf065\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c6394bcaf254c5baf9aff43376020be5db6d3316\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cfb2c6f71d61ed807c9d7a7af331d406f1f31877\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e205f3e7e8c31a47cd11efb6cf663a527177e432\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fb1cae6302d58414ddf029e3f642711bd30243f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-21T11:31:44+00:00",
      "cve": "CVE-2026-68457",
      "id": "CVE-2026-68457",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ksmbd: use opener credentials for FSCTL mutations",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68457.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.