CVE-2025-68806

What it actually does

The smb2_set_ea handler in ksmbd performed EA buffer validation that omitted the single byte required for the null terminator on EaName, allowing an undersized allocation and subsequent out-of-bounds write when an attacker supplies a crafted Extended Attribute name over SMB2.

Why it matters to the business

Successful exploitation can crash kernel file servers or allow arbitrary code execution on systems exposing SMB shares, disrupting file services, authentication, and any workloads that depend on the Linux kernel SMB implementation.

How an attack unfolds

An attacker establishes an SMB2 session to a vulnerable ksmbd server, crafts a SetInfo request containing an Extended Attribute whose EaNameLength value exactly matches the buffer size without the trailing null byte, and triggers the flawed length check so that the subsequent copy writes past the allocated buffer.

How to fix it

Upgrade the Linux kernel to a fixed release containing commit cae52c592a07e1d3fa3338a5f064a374a5f26750 or version 6.1.160 (or later stable branches that include the fix). Rebuild and reboot all affected systems; disable ksmbd if immediate patching is not possible.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking the presence of the commit or version string; test by replaying an EA set request with a maximum-length name and verifying that the server no longer accepts an undersized buffer.

Typical attack path

1. Connect to the target SMB2 share and authenticate
2. Send a specially crafted SMB2_SET_INFO request with an EA whose name length omits the null terminator
3. Trigger the buffer copy in smb2_set_ea that writes one byte beyond the validated region
4. Achieve kernel memory corruption leading to denial of service or code execution

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) and SMB audit logs for unexpected ksmbd crashes or buffer-related warnings around the time of suspected activity; correlate with SMB2 SetInfo requests containing EA names that approach the maximum allowed length.

What your security team should do

• Prioritize kernel updates on all systems that expose ksmbd shares
• Inventory hosts running kernels older than 6.1.160 and schedule emergency patching
• Temporarily disable SMB2 extended attributes via configuration if patching cannot be completed within the next maintenance window