CVE-2026-23093: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23093 is a denial-of-service vulnerability in the Linux kernel's ksmbd (SMB server) component, specifically in the SMBD (SMB Direct over RDMA) subsystem. The flaw arises from incorrect usage of dma_unmap_sg(), which is called with the return value of dma_map_sg() rather than the original nents argument passed to it — a violation of the DMA API contract. Affected kernel versions span 5.15.x (before 5.15.199), 6.1.x (before 6.1.162), 6.6.x (before 6.6.123), 6.12.x (before 6.12.69), 6.13–6.18.x (before 6.18.8), and 6.19 release candidates. It was published on February 4, 2026, with patches added to the stable kernel repository on March 17, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Feedly, CVE Record).

The root cause is an improper use of the Linux DMA scatter-gather API in the ksmbd SMBD transport layer (CWE-399 / resource management error). The dma_map_sg() function accepts a number of scatter-gather entries (nents) and may return a smaller, coalesced count; dma_unmap_sg() must be called with the original nents value, not the mapped count. Passing the wrong value can lead to incomplete unmapping of DMA memory, resulting in memory corruption or a kernel crash. Exploitation requires local access with low privileges and no user interaction, as the vulnerable code path is reachable through the ksmbd SMB server subsystem (Feedly, Kernel Patch).

Successful exploitation allows a local attacker with low privileges to trigger a denial-of-service condition, potentially causing the system to crash or become unresponsive, requiring a reboot. The impact is limited to availability (rated High), with no confidentiality or integrity impact. Affected systems are those running vulnerable kernel versions with the ksmbd module active and SMBD (RDMA) transport in use (Feedly).

Apply the available upstream Linux kernel patches immediately. Fixed versions include: 5.15.199, 6.1.162, 6.6.123, 6.12.69, 6.18.8, and 6.19-rc7. Six patch commits are available in the stable kernel repository. As a workaround, disable the ksmbd kernel module (SMB server) if it is not required, particularly if SMBD/RDMA transport is in use. Restrict local user access on systems where patching cannot be applied immediately. Ubuntu security notices USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, and USN-8297-1 address this issue for Ubuntu users (Ubuntu USN-8180-1, Ubuntu USN-8297-1, Kernel Patch).