CVE-2021-46960

What it actually does

Incorrect positive error code (1) returned from smb2_get_enc_key instead of a negative errno propagates through CIFS write and setattr paths, triggering errseq_set warnings in the kernel error sequence tracking.

Why it matters to the business

Produces noisy kernel warnings and potential logging overhead during routine file operations on SMB/CIFS shares that use encryption; low likelihood of service disruption or data loss given the nature of the flaw.

How an attack unfolds

An attacker with network access to an encrypted CIFS share performs file writes, utimes, or setattr operations that invoke smb2_get_enc_key; the malformed error return causes the warning to be emitted when the error reaches __filemap_set_wb_err.

How to fix it

Update the Linux kernel to a version containing the referenced fix for smb2_get_enc_key error handling; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm absence of the 'err = 1' and errseq_set warning in kernel logs after kernel upgrade; verify CIFS operations complete without triggering the cut-here warning.

Typical attack path

1. Mount an SMB share configured for encryption
2. Perform file write or metadata update operations (utimensat, writepages)
3. Trigger smb2_get_enc_key failure path
4. Observe error code 1 percolate to errseq_set

How to detect it

Search kernel logs and dmesg for the strings 'CIFS VFS:.*crypt_message: Could not get encryption key' and 'WARNING:.*errseq_set+0x5c' along with the associated call trace involving cifs_writepages and cifs_setattr.

• CIFS VFS: .* crypt_message: Could not get encryption key
• err = 1
• WARNING: CPU:.*at.*errseq_set
• cifs_writepages.*cifs
• cifs_setattr.*notify_change

What your security team should do

• Prioritize kernel updates on systems mounting encrypted CIFS shares
• Monitor kernel logs for the specific errseq_set warning
• Test CIFS encryption functionality post-update