CVE-2025-68806: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-68806 is a buffer validation vulnerability in the Linux kernel's ksmbd (in-kernel SMB server) component, specifically in the smb2_set_ea function responsible for handling Extended Attributes (EA). The function incorrectly omitted the null terminator byte (+1) for EA Name during buffer size validation, causing the check to underestimate the required buffer size. It was published on January 13, 2026, and affects Linux kernel versions across the 6.1.x, 6.6.x, 6.12.x, and 6.18.x stable series, as well as pre-release 6.19-rc versions. The CVSS v3.1 base score is 5.5 (Medium), with a local attack vector requiring low privileges (Feedly, Microsoft MSRC).

The root cause is an off-by-one buffer validation error (related to CWE-131: Incorrect Calculation of Buffer Size) in the smb2_set_ea function within the ksmbd subsystem. When processing SMB2 SET_INFO requests for Extended Attributes, the code validated the buffer length against EaNameLength without accounting for the mandatory null terminator byte, meaning a crafted EA name at the boundary of a buffer could pass validation incorrectly. An attacker with local access and low privileges can trigger this flaw by sending malformed Extended Attribute operations over an SMB share served by ksmbd, potentially causing the kernel to read or operate on memory beyond the intended buffer boundary. The fix adds + 1 to EaNameLength in the relevant validation checks to correctly account for the null terminator (Feedly).

Successful exploitation can cause a denial of service, specifically a kernel panic or system crash, on hosts running a vulnerable Linux kernel with ksmbd enabled. The impact is limited to availability — there is no confidentiality or integrity impact per the CVSS assessment. The vulnerability is scoped to the local system and does not provide a path for privilege escalation or lateral movement based on current analysis (Feedly, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the latest available data. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, which significantly limits the attack surface (Feedly).

Patches are available across all affected stable kernel branches. Users should upgrade to the following fixed versions: 6.1.160 (6.1.x series), 6.6.120 (6.6.x series), 6.12.64 (6.12.x series), 6.18.3 (6.18.x series), or 6.19-rc2 (development). Microsoft's Azure Linux kernel patch (version 6.6.119.3-3) was made available on January 15, 2026. Ubuntu security notices USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, and subsequent updates also address this CVE. As a temporary workaround, restrict local access to trusted users only and disable ksmbd if SMB server functionality is not required (Feedly, Microsoft MSRC, Ubuntu USN-8177-1).