CVE-2025-68806: ksmbd: fix buffer validation by including null terminator size in EA length

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-13 · updated 2026-07-30

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix buffer validation by including null terminator size in EA length The smb2_set_ea function, which handles Extended Attributes (EA), was performing buffer validation checks that incorrectly omitted the size of the null terminating character (+1 byte) for EA Name. This patch fixes the issue by explicitly adding '+ 1' to EaNameLength where the null terminator is expected to be present in the buffer, ensuring the validation accurately reflects the total required buffer size.

Affected products

Linux kernel: from 6.1.52 before 6.1.160; from 5.15.131 before 5.16; from 6.4.15 before 6.5; from 6.5.2 before 6.6; 6.6 — fixed in 5.16, 6.1.160, 6.19, 6.5, 6.6

How to fix

Upgrade to a fixed version: Linux kernel 5.16, 6.1.160, 6.19, 6.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-68806 or the next vulnerability affects your stack