CVE-2026-68083

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd component where the ksmbd vfs kern path create() function fails to properly root the create, mkdir, and hardlink sinks. While SMB2 open lookups are rooted at the share using LOOKUP BENEATH, the create process builds an absolute path using convert to unix name() and resolves it from AT FDCWD via start creating path(). This allows an authenticated client to use a ".." component to walk from the real filesystem root and escape the export. This can be triggered by racing a missing path component so that the rooted open lookup returns -ENOENT, while the component is present as a directory when the create walk executes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.