{"id":"CVE-2026-68083","state":"PUBLISHED","title":"ksmbd: fix path resolution in ksmbd_vfs_kern_path_create","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix path resolution in ksmbd_vfs_kern_path_create\n\nThe SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the\ncreate/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an\nabsolute path with convert_to_unix_name() and resolves it from AT_FDCWD\nvia start_creating_path(), so a \"..\" component is walked from the real\nfilesystem root and escapes the export.\n\nAn authenticated client races a missing path component so the rooted open\nlookup returns -ENOENT (taking the create branch) while the same component\nis present (a directory) when the create walk runs; the create then\nresolves \"..\" out of the share.\n\nRoot the create walk at the share like the lookup and rename paths already\nare: resolve the parent with vfs_path_parent_lookup(..., LOOKUP_BENEATH,\n&share_conf->vfs_path) and create the final component with\nstart_creating_noperm(). convert_to_unix_name() then has no callers and is\nremoved.","publishedAt":"2026-08-10T11:41:47.153Z","updatedAt":"2026-10-30T12:28:02.157Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"f1f53dc95edfb3d2072e5e8cd8eb9a2fe7d7f2d0","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"a2516be69048856e2a49a51e00975dc59431f95c","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"489d1ded01425c0fb33418172c0e4e588467526b","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"c7c884a1305aa4540eb7942a50bd356b34120e1f","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"98185b3025beeae92d1fe700d5db26b9ac4bf025","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"1c8951963d8ed357f70f59e0ad4ddce2199d2016","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/misc.c","fs/smb/server/misc.h","fs/smb/server/vfs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/misc.c","fs/smb/server/misc.h","fs/smb/server/vfs.c"]}],"references":["https://git.kernel.org/stable/c/f1f53dc95edfb3d2072e5e8cd8eb9a2fe7d7f2d0","https://git.kernel.org/stable/c/a2516be69048856e2a49a51e00975dc59431f95c","https://git.kernel.org/stable/c/489d1ded01425c0fb33418172c0e4e588467526b","https://git.kernel.org/stable/c/c7c884a1305aa4540eb7942a50bd356b34120e1f","https://git.kernel.org/stable/c/98185b3025beeae92d1fe700d5db26b9ac4bf025","https://git.kernel.org/stable/c/1c8951963d8ed357f70f59e0ad4ddce2199d2016"],"weaknesses":[],"ingestedAt":"2026-10-30T12:46:06.359Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68083.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68083","state":"PUBLISHED","datePublished":"2026-08-10T11:41:47.153Z","dateUpdated":"2026-10-30T12:28:02.157Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.367Z"},"containers":{"cna":{"title":"ksmbd: fix path resolution in ksmbd_vfs_kern_path_create","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix path resolution in ksmbd_vfs_kern_path_create\n\nThe SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the\ncreate/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an\nabsolute path with convert_to_unix_name() and resolves it from AT_FDCWD\nvia start_creating_path(), so a \"..\" component is walked from the real\nfilesystem root and escapes the export.\n\nAn authenticated client races a missing path component so the rooted open\nlookup returns -ENOENT (taking the create branch) while the same component\nis present (a directory) when the create walk runs; the create then\nresolves \"..\" out of the share.\n\nRoot the create walk at the share like the lookup and rename paths already\nare: resolve the parent with vfs_path_parent_lookup(..., LOOKUP_BENEATH,\n&share_conf->vfs_path) and create the final component with\nstart_creating_noperm(). convert_to_unix_name() then has no callers and is\nremoved."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"f1f53dc95edfb3d2072e5e8cd8eb9a2fe7d7f2d0","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"a2516be69048856e2a49a51e00975dc59431f95c","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"489d1ded01425c0fb33418172c0e4e588467526b","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"c7c884a1305aa4540eb7942a50bd356b34120e1f","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"98185b3025beeae92d1fe700d5db26b9ac4bf025","versionType":"git"},{"version":"265fd1991c1db85fbabaad4946ca0e63e2ae688d","status":"affected","lessThan":"1c8951963d8ed357f70f59e0ad4ddce2199d2016","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/misc.c","fs/smb/server/misc.h","fs/smb/server/vfs.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/smb/server/misc.c","fs/smb/server/misc.h","fs/smb/server/vfs.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f1f53dc95edfb3d2072e5e8cd8eb9a2fe7d7f2d0"},{"url":"https://git.kernel.org/stable/c/a2516be69048856e2a49a51e00975dc59431f95c"},{"url":"https://git.kernel.org/stable/c/489d1ded01425c0fb33418172c0e4e588467526b"},{"url":"https://git.kernel.org/stable/c/c7c884a1305aa4540eb7942a50bd356b34120e1f"},{"url":"https://git.kernel.org/stable/c/98185b3025beeae92d1fe700d5db26b9ac4bf025"},{"url":"https://git.kernel.org/stable/c/1c8951963d8ed357f70f59e0ad4ddce2199d2016"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - ksmbd is the in-kernel SMB server on TCP/445; the flaw is reached from remote SMB2_CREATE (and SMB2_SET_INFO hardlink) requests processed in ksmbd_conn_handler_loop() through smb2_open()/smb2_create_link() into ksmbd_vfs_kern_path_create().\nAC:L - Exploitation requires a TOCTOU race, but the attacker controls both sides by issuing concurrent SMB2_CREATE and directory-creation requests over one or more connections, so success does not depend on conditions outside attacker influence.\nPR:N - SMB2_CREATE requires a valid session, tree connect, and writable share, but ksmbd supports guest/anonymous sessions on writable exports; per kernel CNA precedent, export write access alone is not elevated privilege.\nUI:N - No victim interaction is required; the attacker sends crafted SMB2 protocol requests directly to a reachable ksmbd service without needing another user to mount shares or open files.\nS:U - Impact is confined to the host kernel filesystem namespace managed by ksmbd; escaping an SMB export is not a VM, IOMMU, or separate security-authority boundary crossing.\nC:N - This is a path-resolution logic flaw with no memory corruption, out-of-bounds access, or demonstrated arbitrary read of host files outside the export; impact is unauthorized creation/linking, not information disclosure.\nI:H - ksmbd_vfs_kern_path_create() resolves attacker paths from AT_FDCWD without LOOKUP_BENEATH, letting authenticated clients create files, directories, or hardlinks outside the exported share using the server's filesystem credentials.\nA:H - Repeated successful escaped creates/mkdirs outside the export can exhaust root-filesystem inodes or storage (especially tmpfs/world-writable targets), causing system-wide service unavailability on affected NAS/cloud hosts."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:28:02.157Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}