{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68457", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.395Z", "datePublished": "2026-08-15T05:51:18.233Z", "dateUpdated": "2026-08-18T06:56:05.565Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-18T06:56:05.565Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for FSCTL mutations\n\nSET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB\nhandle but call VFS xattr, fallocate or fileattr helpers with the current\nksmbd worker credentials. Those helpers can revalidate inode permissions,\nownership and LSM policy independently of the SMB handle access mask.\n\nRun each operation with the credentials captured in the target file when\nthe handle was opened. Keep credential handling local to these single-file\nFSCTLs rather than applying session credentials to the complete IOCTL\nhandler, which also contains handle-less and multi-handle operations."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is in ksmbd's SMB2 IOCTL handler, reachable remotely over TCP/445 (or SMB Direct) via smb2_ioctl() processing FSCTL_SET_SPARSE, FSCTL_SET_ZERO_DATA, and FSCTL_SET_COMPRESSION after SMB2 session setup and tree connect.\nAC:L - An attacker deterministically opens a target file handle and sends the FSCTL; smb2_ioctl() never calls ksmbd_override_fsids(), so VFS helpers always run with privileged worker credentials instead of filp->f_cred, making the bypass reliable without races or external timing.\nPR:N - Although a valid SMB session, writable tree, and handle with FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES are required, ksmbd supports passwordless guest sessions on guest-writable shares, so exploitation does not require prior host privileges in a reasonable deployment.\nUI:N - The attacker directly issues SMB2 IOCTL requests against handles it opened; no separate victim action such as mounting a share, opening a file, or clicking a prompt is required beyond network access to ksmbd.\nS:U - The credential bypass permits unauthorized file metadata and content mutations within the same host kernel and exported filesystem security authority; it does not cross VM, container, IOMMU, or comparable isolation boundaries.\nC:N - These FSCTLs only mutate sparse/compression xattrs or zero/punch file ranges via vfs_fallocate and vfs_fileattr helpers; they provide no read primitive, kernel memory disclosure, or alternate unauthorized data exfiltration path.\nI:H - Privileged ksmbd worker credentials bypass opener UID, group, capability, inode, and LSM revalidation in vfs_fallocate, vfs_fileattr_set, and ksmbd_vfs_set_dos_attrib_xattr, enabling unauthorized sparse/compression attribute changes and arbitrary-range zeroing or hole-punching of protected files.\nA:H - Repeated FSCTL_SET_ZERO_DATA requests can persistently destroy or corrupt critical exported files and dependent services by zeroing or punching arbitrary ranges with root-equivalent credentials, causing sustained loss of share data and service availability until restoration."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c", "fs/smb/server/vfs.c"], "versions": [{"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "a8c18434e1f0d9f7989170bdb0490c0160baf065", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "fb1cae6302d58414ddf029e3f642711bd30243f7", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "e205f3e7e8c31a47cd11efb6cf663a527177e432", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "cfb2c6f71d61ed807c9d7a7af331d406f1f31877", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "c6394bcaf254c5baf9aff43376020be5db6d3316", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c", "fs/smb/server/vfs.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a8c18434e1f0d9f7989170bdb0490c0160baf065"}, {"url": "https://git.kernel.org/stable/c/1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2"}, {"url": "https://git.kernel.org/stable/c/fb1cae6302d58414ddf029e3f642711bd30243f7"}, {"url": "https://git.kernel.org/stable/c/e205f3e7e8c31a47cd11efb6cf663a527177e432"}, {"url": "https://git.kernel.org/stable/c/cfb2c6f71d61ed807c9d7a7af331d406f1f31877"}, {"url": "https://git.kernel.org/stable/c/c6394bcaf254c5baf9aff43376020be5db6d3316"}], "title": "ksmbd: use opener credentials for FSCTL mutations", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c", "fs/smb/server/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a8c18434e1f0d9f7989170bdb0490c0160baf065", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "fb1cae6302d58414ddf029e3f642711bd30243f7", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "e205f3e7e8c31a47cd11efb6cf663a527177e432", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "cfb2c6f71d61ed807c9d7a7af331d406f1f31877", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "c6394bcaf254c5baf9aff43376020be5db6d3316", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c", "fs/smb/server/vfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for FSCTL mutations\n\nSET_SPARSE, SET_ZERO_DATA and SET_COMPRESSION operate on an open SMB\nhandle but call VFS xattr, fallocate or fileattr helpers with the current\nksmbd worker credentials. Those helpers can revalidate inode permissions,\nownership and LSM policy independently of the SMB handle access mask.\n\nRun each operation with the credentials captured in the target file when\nthe handle was opened. Keep credential handling local to these single-file\nFSCTLs rather than applying session credentials to the complete IOCTL\nhandler, which also contains handle-less and multi-handle operations."}], "id": "CVE-2026-68457", "lastModified": "2026-08-18T07:16:52.283", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:17:48.460", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1e112c47ec5dd1942e2d4ca6e8e9b712238e20c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8c18434e1f0d9f7989170bdb0490c0160baf065"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c6394bcaf254c5baf9aff43376020be5db6d3316"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cfb2c6f71d61ed807c9d7a7af331d406f1f31877"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e205f3e7e8c31a47cd11efb6cf663a527177e432"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb1cae6302d58414ddf029e3f642711bd30243f7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ksmbd: use opener credentials for FSCTL mutations", "id": "2516738", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516738"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-270", "details": ["A flaw was found in ksmbd in the Linux kernel. This vulnerability allows certain file system control (FSCTL) operations, specifically SET_SPARSE, SET_ZERO_DATA, and SET_COMPRESSION, to use incorrect credentials. Consequently, these operations can bypass the security checks established when the file was initially opened. This could enable a local attacker to perform unauthorized modifications to files, circumventing intended access restrictions."], "name": "CVE-2026-68457", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68457\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68457\nhttps://lore.kernel.org/linux-cve-announce/2026081502-CVE-2026-68457-eb4d@gregkh/T"], "threat_severity": "Important"}