CVE-2026-43377
ksmbd Credential Exposure in SMB3 Key Generation
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | ksmbd | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's ksmbd component. When the KSMBD_DEBUG_AUTH logging feature is enabled, the functions generate_smb3signingkey() and generate_smb3encryptionkey() log sensitive key bytes related to session, signing, encryption, and decryption. This logging exposes credentials that should remain confidential.
The vulnerability was resolved by removing these logs to prevent the exposure of sensitive keys.
How can this vulnerability impact me? :
If exploited, this vulnerability could lead to the exposure of sensitive cryptographic keys used for SMB3 signing and encryption. This exposure could allow attackers to compromise the confidentiality and integrity of SMB3 sessions, potentially leading to unauthorized access or data interception.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, disable the KSMBD_DEBUG_AUTH logging feature if it is enabled, as it causes sensitive key material to be logged.
Ensure your Linux kernel is updated to a version where this issue is resolved, as the vulnerability has been fixed by removing the logging of keys in SMB3 signing and encryption key generation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves logging sensitive key material (session, signing, encryption, and decryption keys) when debug logging is enabled in the Linux kernel's ksmbd component. Exposing such credentials in logs could lead to unauthorized access or data breaches.
From a compliance perspective, logging sensitive cryptographic keys may violate data protection requirements under standards like GDPR and HIPAA, which mandate the protection of sensitive information and the prevention of unauthorized disclosure.
By removing the logging of these keys, the vulnerability fix helps reduce the risk of sensitive data exposure, thereby supporting compliance with these regulations.