CVE-2026-68431

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ksmbd module where the receive path only applies the minimum SMB2 PDU (Protocol Data Unit) size check when the ProtocolId is SMB2 PROTO NUMBER. Packets using SMB2 TRANSFORM PROTO NUM can bypass this check, even if the negotiated dialect does not support transform handling. On SMB 2.1 connections, a short transform packet can reach the init smb2 rsp hdr() function, which treats the request as a full SMB2 header and reads memory beyond the request allocation. This allows an unauthenticated client to receive the copied memory fields.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.