https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 18:59:14 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68083 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix path resolution in ksmbd_vfs_kern_path_create</p> <p>The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the create/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an absolute path with convert_to_unix_name() and resolves it from AT_FDCWD via start_creating_path(), so a &#34;..&#34; component is walked from the real filesystem root and escapes the export.</p> <p>An authenticated client races a missing path component so the rooted open lookup returns -ENOENT (taking the create branch) while the same component is present (a directory) when the create walk runs; the create then resolves &#34;..&#34; out of the share.</p> <p>Root the create walk at the share like the lookup and rename paths already are: resolve the parent with vfs_path_parent_lookup(..., LOOKUP_BENEATH, &amp;share_conf-&gt;vfs_path) and create the final component with start_creating_noperm(). convert_to_unix_name() then has no callers and is removed.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ksmbd: fix path resolution in ksmbd_vfs_kern_path_create</p> <p>The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the create/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an absolute path with convert_to_unix_name() and resolves it from AT_FDCWD via start_creating_path(), so a &#34;..&#34; component is walked from the real filesystem root and escapes the export.</p> <p>An authenticated client races a missing path component so the rooted open lookup returns -ENOENT (taking the create branch) while the same component is present (a directory) when the create walk runs; the create then resolves &#34;..&#34; out of the share.</p> <p>Root the create walk at the share like the lookup and rename paths already are: resolve the parent with vfs_path_parent_lookup(..., LOOKUP_BENEATH, &amp;share_conf-&gt;vfs_path) and create the final component with start_creating_noperm(). convert_to_unix_name() then has no callers and is removed.</p> https://vulnerability.circl.lu/vuln/cve-2026-68083