CVE-2025-68806

ksmbd: fix buffer validation by including null terminator size in EA length

published January 13, 2026

CVSS
—
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix buffer validation by including null terminator size in EA length

The smb2_set_ea function, which handles Extended Attributes (EA),

was performing buffer validation checks that incorrectly omitted the size

of the null terminating character (+1 byte) for EA Name.

This patch fixes the issue by explicitly adding '+ 1' to EaNameLength where

the null terminator is expected to be present in the buffer, ensuring

the validation accurately reflects the total required buffer size.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.8th percentile
Published
2026-01-13T15:29Z
EPSS history
Timeline
  • 13 JAN 15:29Z
    ksmbd: fix buffer validation by including null terminator size in EA length
    cvelistv5