Look up another CVE · open CVE-2026-43362 in the interactive tracker
CVE-2026-43362
smb: client: fix in-place encryption corruption in SMB2_write()
Published 2026-05-08 (5 months ago) by the Linux kernel CNA. Subsystem fs/smb. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-43362 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.85-1 | Update the kernel and reboot. Fixed in 6.12.85-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 6.19.10-1 | Update the kernel and reboot. Fixed in 6.19.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 6.19.10-1 | Update the kernel and reboot. Fixed in 6.19.10-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
SMB2_write() places write payload in iov[1..n] as part of rq_iov. smb3_init_transform_rq() pointer-shares rq_iov, so crypt_message() encrypts iov[1] in-place, replacing the original plaintext with ciphertext. On a replayable error, the retry sends the same iov[1] which now contains ciphertext instead of the original data, resulting in corruption. The corruption is most likely to be observed when connections are unstable, as reconnects trigger write retries that re-send the already-encrypted data. This affects SFU mknod, MF symlinks, etc. On kernels before 6.10 (prior to the netfs conversion), sync writes also used this path and were similarly affected. The async write path wasn't unaffected as it uses rq_iter which gets deep-copied. Fix by moving the write payload into rq_iter via iov_iter_kvec(), so smb3_init_transform_rq() deep-copies it before encryption.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/smb/client/smb2pdu.c
- What this is
- COMMON INTERNET FILE SYSTEM CLIENT (CIFS and SMB3)MAINTAINERS section matched on fs/smb/client/ · linux-cifs@vger.kernel.org · Supported
- Kernel module
- cifs
Check it on the machine
grep -wE 'CONFIG_CIFS|CONFIG_SMBFS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cifsPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_CIFS, CONFIG_SMBFS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-05-08 (5 months ago)source
- CVSS
- 8.1 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.31%, higher than 22.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/smb
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.11 | 6.6.130 | 438e77435aee |
| 4.11 | 6.12.78 | 52327268224f |
| 4.11 | 6.18.19 | 92e64f1852f4 |
| 4.11 | 6.19.9 | aea5e37388a0 |
| 4.11 | 7.0 | d78840a6a38d |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable SMB client write path is reached over an SMB3 network connection, and a malicious SMB server or network attacker able to force reconnects can trigger the retry after encryption.
- AC:LAttack complexity, low
- The required conditions are straightforward: SMB3 encryption enabled, a write through `SMB2_write()`, and a replayable `-EAGAIN`/`-ECONNABORTED` error that the remote endpoint can plausibly induce by dropping/resetting the connection.
- PR:NPrivileges required, none
- The attacker does not need privileges on the victim system; the attack can be mounted by the remote SMB endpoint or network adversary against a client that connects and writes to the share.
- UI:RUser interaction, required
- A victim system or user must mount/use the SMB share and perform writes, such as ordinary buffered writes on affected pre-6.10 kernels or symlink/SFU special-file operations on later affected kernels.
- S:UScope, unchanged
- The corruption occurs within the SMB client/filesystem write security context and does not cross a VM, sandbox, IOMMU, or comparable security boundary.
- C:NConfidentiality impact, none
- The bug corrupts plaintext buffers into ciphertext and stores garbage on retry, but it does not provide a new information disclosure primitive or kernel memory read.
- I:HIntegrity impact, high
- The attacker can cause durable corruption of file contents written through the encrypted SMB client path, including ordinary file writes on affected pre-6.10 kernels, so high integrity impact is defensible.
- A:HAvailability impact, high
- Repeated durable corruption of files being written to an encrypted SMB share can render application data or filesystem contents unusable, creating high availability impact in severe deployments.