ksmbd multichannel session-key stack buffer overflow
ksmbd stack buffer overflow in multichannel session binding: 40 bytes copied into a 16-byte kernel stack buffer. Patched in Linux stable; no CVSS assigned yet.
- Vendor
- Linux Kernel
- Product
- ksmbd (in-kernel SMB3 server, Linux ≥5.15)
- CVSS
- N/A
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Stack buffer overflow in ksmbd’s multichannel session-key copy path. A prior commit (4b706360ffb7) reorganized session key storage — moving the binding-path key out of the 40-byte session-wide sess->sess_key field into a new per-channel buffer sized to 16 bytes (SMB2_NTLMV2_SESSKEY_SIZE). Copy operations referencing the old layout still used the 40-byte length, overflowing the kernel stack buffer by 24 bytes during SMB3 multichannel session binding.
Affected: Linux systems running ksmbd (upstream kernel ≥5.15) with SMB3 multichannel connections in use.
Patch: linux-kernel stable commit 610346149d04. Update to latest stable kernel.
No CVSS score assigned by NVD as of 2026-08-15. Severity designation (high) reflects the described impact — kernel-context stack overflow in a network-facing server — pending NVD assignment. No exploitation in the wild confirmed. No CISA KEV addition as of publication.
Source: NVD — CVE-2026-72044
