Linux ksmbd SMB Server: Stack Overflow Fix in Stable

The August 15 kernel stable drop carried over thirty CVEs. Most are maintenance — reference counting, resource leaks, bounds checks on paths nobody reaches in production. CVE-2026-72044 is worth separating out.

It’s a stack buffer overflow in ksmbd, the Linux kernel’s in-kernel SMB3 server. The affected path is multichannel session-key copying — the mechanism SMB3 clients use to establish multiple network channels to the same server for throughput. The bug traces to a prior refactor (commit 4b706360ffb7) that moved the binding-path session key out of the session-wide 40-byte sess->sess_key field and into a per-channel buffer sized to 16 bytes (SMB2_NTLMV2_SESSKEY_SIZE). Copy operations that reference the old layout still used the 40-byte length — overflowing the 16-byte kernel stack buffer by 24 bytes during multichannel session binding.

No CVSS assigned by NVD as of publication. Fix committed to stable: 610346149d04. Published NVD entry: CVE-2026-72044.

What ksmbd is: ksmbd landed in Linux 5.15 as an in-kernel SMB3 implementation — a performance alternative to Samba’s userspace daemon. It processes SMB3 connections inside the kernel networking stack, where bugs operate at ring 0 rather than inside an isolated process.

Analysis: Moving complex protocol servers in-kernel is a tradeoff the kernel community has made repeatedly — NFS, iSCSI, now SMB3. The performance case is real. So is the expanded kernel attack surface that comes with it. A buffer size mismatch between a refactored struct and its copy site is exactly the category of bug this kind of code produces: localized, easy to miss in review, quiet until something triggers the affected path.

What the practical exposure looks like — what a client needs to send to reach the multichannel binding path, and from what network position — isn’t answered by the commit description alone. That context will come once NVD assigns severity or a researcher publishes a fuller analysis. For now: if you run ksmbd with multichannel enabled, patch to the latest stable.

No exploitation confirmed in the wild. No CISA KEV addition as of this writing.

Related: Linux Kernel Patches WiFi Heap Overflow, BPF Bypass