CVE-2026-89792

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Malformed payload_sz/veto_list_sz and unterminated veto/path bytes are consumed from a ksmbd generic-netlink SHARE_CONFIG_RESPONSE (handle_generic_event → ipc_validate_msg → share_config_request), not from SMB PDUs. A remote TREE_CONNECT only creates the pending IPC request; the attacker must be local to inject or control that response.

AC:LAttack complexity, low

The attacker fully controls the crafted netlink length fields and can set payload_sz to 0 or omit NULs so the old checks pass. Pending handles come from a small IDA and can be brute-forced against a TREE_CONNECT the attacker also triggers; no victim timing or rare config is required.

PR:LPrivileges required, low

handle_generic_event requires CAP_NET_ADMIN only when CONFIG_SMB_SERVER_CHECK_CAP_NET_ADMIN is set; SMBD_GENL is netns-aware, has no GENL_ADMIN_PERM, and does not bind responses to ksmbd_tools_pid. That capability is Low, and builds that disable the check allow any local user to send the message.

UI:NUser interaction, none

The attacker sends the malformed SHARE_CONFIG_RESPONSE and can issue the matching SMB2 TREE_CONNECT themselves; no separate victim or administrator action is required once ksmbd is running.

S:UScope, unchanged

The out-of-bounds reads and any resulting oops remain inside the ksmbd/kernel security authority on the host. This is not a VM escape, IOMMU/DMA bypass, or other cross-boundary impact.

C:HConfidentiality impact, high

With payload_sz==0 the kernel kstrndup()s up to PATH_MAX bytes past the IPC object, and parse_veto_list() uses unbounded strlen()/kstrdup() when the veto buffer lacks a NUL within veto_list_sz. Those are large kernel-heap over-reads, not a few bounded bytes.

I:NIntegrity impact, none

The defects are out-of-bounds reads (strlen, kstrndup, kstrdup) into newly allocated strings; there is no out-of-bounds write or control-flow hijack primitive. A local IPC sender can already supply a well-formed share path without this bug.

A:HAvailability impact, high

Walking strlen() or kstrndup(..., PATH_MAX) off the end of the IPC slab into unmapped memory oopses the ksmbd worker. The attacker can repeat the crafted response against further TREE_CONNECT-triggered requests and crash the kernel at will.