CVE-2026-68083

ksmbd: fix path resolution in ksmbd_vfs_kern_path_create

State: Published
Severity: 9.1 Critical
Published: Aug 10, 2026
Updated: Oct 30, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix path resolution in ksmbd_vfs_kern_path_create

The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the create/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an absolute path with convert_to_unix_name() and resolves it from AT_FDCWD via start_creating_path(), so a ".." component is walked from the real filesystem root and escapes the export.

An authenticated client races a missing path component so the rooted open lookup returns -ENOENT (taking the create branch) while the same component is present (a directory) when the create walk runs; the create then resolves ".." out of the share.

Root the create walk at the share like the lookup and rename paths already are: resolve the parent with vfs_path_parent_lookup(..., LOOKUP_BENEATH, &share_conf->vfs_path) and create the final component with start_creating_noperm(). convert_to_unix_name() then has no callers and is removed.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	265fd1991c1db85fbabaad4946ca0e63e2ae688d to before f1f53dc95edfb3d2072e5e8cd8eb9a2fe7d7f2d0Affected 265fd1991c1db85fbabaad4946ca0e63e2ae688d to before a2516be69048856e2a49a51e00975dc59431f95cAffected 265fd1991c1db85fbabaad4946ca0e63e2ae688d to before 489d1ded01425c0fb33418172c0e4e588467526bAffected 265fd1991c1db85fbabaad4946ca0e63e2ae688d to before c7c884a1305aa4540eb7942a50bd356b34120e1fAffected 265fd1991c1db85fbabaad4946ca0e63e2ae688d to before 98185b3025beeae92d1fe700d5db26b9ac4bf025Affected 265fd1991c1db85fbabaad4946ca0e63e2ae688d to before 1c8951963d8ed357f70f59e0ad4ddce2199d2016Affected
LinuxLinux	5.15Affected before 5.15Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

265fd1991c1db85fbabaad4946ca0e63e2ae688d to before f1f53dc95edfb3d2072e5e8cd8eb9a2fe7d7f2d0Affected
265fd1991c1db85fbabaad4946ca0e63e2ae688d to before a2516be69048856e2a49a51e00975dc59431f95cAffected
265fd1991c1db85fbabaad4946ca0e63e2ae688d to before 489d1ded01425c0fb33418172c0e4e588467526bAffected
265fd1991c1db85fbabaad4946ca0e63e2ae688d to before c7c884a1305aa4540eb7942a50bd356b34120e1fAffected
265fd1991c1db85fbabaad4946ca0e63e2ae688d to before 98185b3025beeae92d1fe700d5db26b9ac4bf025Affected
265fd1991c1db85fbabaad4946ca0e63e2ae688d to before 1c8951963d8ed357f70f59e0ad4ddce2199d2016Affected

LinuxLinux

5.15Affected
before 5.15Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.