turtlearm/ksmbraceksmbd CVEs: CVE-2026-31717, CVE-2026-68083
Vulnerability research in ksmbd, the Linux kernel's in-kernel SMB3 server
(fs/smb/server/). Authenticated-attacker flaws on the durable-handle and path-resolution
paths of ksmbd. The name nods to the race-condition theme of this line of work
(see the withheld byte-range-lock UAF, CVE-2026-64396, fixed in d20d1c8ba576).
Both are fixed upstream. Each subdirectory is named by its CVE and carries a short writeup plus a proof-of-concept or verifier. Full weaponization is withheld where a verifier already clarifies the vulnerable state.
Found and reported by Davide Ornaghi.
| CVE | flaw | class | artifact |
|---|---|---|---|
| CVE-2026-31717 | durable-handle reconnect hijacks another user's f_cred (no owner check) | CWE-863 access-control bypass | ACL-bypass PoC |
| CVE-2026-68083 | create/mkdir/hardlink sink escapes the share via .. (un-rooted path) | CWE-22 path traversal (TOCTOU race) | verifier |
| CVE | mainline fix | landed |
|---|---|---|
| CVE-2026-31717 | 49110a8ce654 "ksmbd: validate owner of durable handle on reconnect" | — |
| CVE-2026-68083 | 1c8951963d8e "ksmbd: fix path resolution in ksmbd_vfs_kern_path_create" | 6.12.97, 6.18.40, 7.1.5, 7.2 |
Published after each fix shipped in supported stable branches. For patch validation, detection engineering, and defensive testing on systems you own or are authorised to test.
