Linux Kernel KSMBD information disclosure flaw: check the service and apply updates

Zero Day Initiative published advisory ZDI-26-1004 for a flaw in KSMBD, a Linux Kernel component that provides SMB file-sharing services. This article summarizes the affected condition, technical details, and response guidance from the ZDI-26-1004 advisory.

Overview and technical details

The flaw occurs because a request buffer is not properly initialized before access in the ksmbd_conn_handler_loop function. A remote attacker could exploit the flaw to disclose sensitive information.

The record says authentication is not required for exploitation, while the CVSS vector lists PR:L. These two details are preserved as provided by the source. The record also says an attacker could combine this flaw with other vulnerabilities to execute arbitrary code in the kernel context; it does not state that this flaw alone directly results in code execution.

Affected systems

Only systems with ksmbd enabled are affected. The record does not provide affected Linux version branches or a specific fixed version.

System checks

1. Check whether the ksmbd service is enabled or active:

   Copy commands

   systemctl is-enabled ksmbd
   systemctl is-active ksmbd

   If the service is enabled or active, the system meets the exposure condition stated in the advisory.

2. Check whether the ksmbd module is loaded:

   Copy commands

   lsmod | grep '^ksmbd'

   If ksmbd is returned, the module is loaded and a Linux update containing the fix should be applied.

Remediation and mitigation

1. Prioritize remediation during the next maintenance window on systems with ksmbd enabled.

2. Apply a Linux update containing the fix. The record links to the Linux fix for reference.

References

• Zero Day Initiative: ZDI-26-1004
• Linux: fix commit