SB2026081310 - Path traversal in Linux kernel smb server

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: CVE-2026-68083)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to access files outside the exported share.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in ksmbd_vfs_kern_path_create() when handling SMB create, mkdir, or hardlink operations with crafted path components. A remote user can race a missing path component and use a ".." path element to access files outside the exported share.

Exploitation requires authentication to the SMB service and a race condition between the rooted lookup and the create path resolution.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1c8951963d8ed357f70f59e0ad4ddce2199d2016
• https://git.kernel.org/stable/c/489d1ded01425c0fb33418172c0e4e588467526b
• https://git.kernel.org/stable/c/98185b3025beeae92d1fe700d5db26b9ac4bf025
• https://git.kernel.org/stable/c/c7c884a1305aa4540eb7942a50bd356b34120e1f