{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68083","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.367Z","datePublished":"2026-08-10T11:41:47.153Z","dateUpdated":"2026-08-17T04:58:30.819Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T04:58:30.819Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix path resolution in ksmbd_vfs_kern_path_create\n\nThe SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the\ncreate/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an\nabsolute path with convert_to_unix_name() and resolves it from AT_FDCWD\nvia start_creating_path(), so a \"..\" component is walked from the real\nfilesystem root and escapes the export.\n\nAn authenticated client races a missing path component so the rooted open\nlookup returns -ENOENT (taking the create branch) while the same component\nis present (a directory) when the create walk runs; the create then\nresolves \"..\" out of the share.\n\nRoot the create walk at the share like the lookup and rename paths already\nare: resolve the parent with vfs_path_parent_lookup(..., LOOKUP_BENEATH,\n&share_conf->vfs_path) and create the final component with\nstart_creating_noperm(). convert_to_unix_name() then has no callers and is\nremoved."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - ksmbd is the in-kernel SMB server on TCP/445; the flaw is reached from remote SMB2_CREATE (and SMB2_SET_INFO hardlink) requests processed in ksmbd_conn_handler_loop() through smb2_open()/smb2_create_link() into ksmbd_vfs_kern_path_create().\nAC:L - Exploitation requires a TOCTOU race, but the attacker controls both sides by issuing concurrent SMB2_CREATE and directory-creation requests over one or more connections, so success does not depend on conditions outside attacker influence.\nPR:N - SMB2_CREATE requires a valid session, tree connect, and writable share, but ksmbd supports guest/anonymous sessions on writable exports; per kernel CNA precedent, export write access alone is not elevated privilege.\nUI:N - No victim interaction is required; the attacker sends crafted SMB2 protocol requests directly to a reachable ksmbd service without needing another user to mount shares or open files.\nS:U - Impact is confined to the host kernel filesystem namespace managed by ksmbd; escaping an SMB export is not a VM, IOMMU, or separate security-authority boundary crossing.\nC:N - This is a path-resolution logic flaw with no memory corruption, out-of-bounds access, or demonstrated arbitrary read of host files outside the export; impact is unauthorized creation/linking, not information disclosure.\nI:H - ksmbd_vfs_kern_path_create() resolves attacker paths from AT_FDCWD without LOOKUP_BENEATH, letting authenticated clients create files, directories, or hardlinks outside the exported share using the server's filesystem credentials.\nA:H - Repeated successful escaped creates/mkdirs outside the export can exhaust root-filesystem inodes or storage (especially tmpfs/world-writable targets), causing system-wide service unavailability on affected NAS/cloud hosts."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/misc.c","fs/smb/server/misc.h","fs/smb/server/vfs.c"],"versions":[{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","lessThan":"489d1ded01425c0fb33418172c0e4e588467526b","status":"affected","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","lessThan":"c7c884a1305aa4540eb7942a50bd356b34120e1f","status":"affected","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","lessThan":"98185b3025beeae92d1fe700d5db26b9ac4bf025","status":"affected","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","lessThan":"1c8951963d8ed357f70f59e0ad4ddce2199d2016","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/misc.c","fs/smb/server/misc.h","fs/smb/server/vfs.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/489d1ded01425c0fb33418172c0e4e588467526b"},{"url":"https://git.kernel.org/stable/c/c7c884a1305aa4540eb7942a50bd356b34120e1f"},{"url":"https://git.kernel.org/stable/c/98185b3025beeae92d1fe700d5db26b9ac4bf025"},{"url":"https://git.kernel.org/stable/c/1c8951963d8ed357f70f59e0ad4ddce2199d2016"}],"title":"ksmbd: fix path resolution in ksmbd_vfs_kern_path_create","x_generator":{"engine":"bippy-1.2.0"}}}}