Daily update · Sep 1–2, 2026
SMB subsystem lands wave of security and data-corruption fixes
ksmbd gets hardened against heap leaks and buffer overflows, the CIFS client fixes multiple fallocate data-corruption bugs, and Steve French's passing is reflected in maintainer updates.
In brief
Today's mainline commits are entirely within the SMB subsystem, addressing multiple security vulnerabilities in the ksmbd in-kernel server and several data-corruption bugs in the CIFS client's fallocate and truncate paths. The changes also formally update maintainership following Steve French's passing.
ksmbd server security fixes
Heap memory leak via pipe read compound padding
When ksmbd handles a compound SMB2 read on a named pipe, it allocates only the payload size but the compound response handler extends the last iov to an eight-byte boundary, exposing up to seven bytes of uninitialized kernel heap memory to the client. The fix allocates the aligned size and zeroes the tail before pinning the response buffer.
Why it matters: An authenticated client could read uninitialized kernel heap bytes from the server.
Buffer overflow in normalized file name responses
ksmbd left FILE_NORMALIZED_NAME_INFORMATION responses in a small 448-byte buffer and converted the file path to UTF-16 without checking remaining space, allowing an authenticated client with a long path to write beyond the response buffer. The fix uses the large response buffer and validates space for worst-case UTF-16 output plus terminator.
Why it matters: An authenticated client could trigger an out-of-bounds write on the server.
Out-of-bounds reads in share config responses
ksmbd's IPC share configuration handling consumed variable-length fields without validating payload sizes, allowing out-of-bounds reads in veto list parsing and path length derivation. The fix validates payload sizes before consuming variable-length fields.
Why it matters: Malformed IPC responses could cause out-of-bounds reads in the server.
Listener task lifetime race on netdev events
When a netdevice event shuts down the listening socket, the listener thread could exit and have its task_struct freed before kthread_stop() obtains its reference. The fix creates the listener in a stopped state, holds an extra task_struct reference until kthread_stop_put() completes, and stops listeners before freeing interface records.
Why it matters: A network configuration change could trigger a use-after-free of the listener task_struct.
DACL parsing errors silently accepted
parse_dacl() silently accepted truncated ACEs and allocation failures, allowing set_info_sec() to continue with an incomplete ACL conversion. The fix propagates parsing and allocation errors so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.
Why it matters: A malformed security descriptor could lead to an incomplete ACL being applied to a file.
Information leak via uninitialized response fields in compound requests
Three separate ksmbd filesystem information queries (FS_OBJECT_ID_INFORMATION, FS_CONTROL_INFORMATION, FS_POSIX_INFORMATION) reported fixed-size responses without initializing all fields. While standalone requests were safe due to zeroed allocation, compound requests could leak up to 31 bytes of stale buffer content from a previous response. The fixes explicitly initialize the previously unset fields.
Why it matters: An authenticated client could potentially read stale kernel heap data via compound requests.
Session teardown race in multichannel logoff
SMB3 multichannel allows one session to run on multiple connections, but session teardown during LOGOFF did not wait for all bound channels or properly handle deferred byte-range locks, synchronous CANCEL requests, and CHANGE_NOTIFY completions. The fix serializes teardown with channel registration and uses atomic work-state transitions.
Why it matters: Premature freeing of shared session objects during LOGOFF could cause crashes under multichannel workloads.
Kernel log flooding from unmapped SIDs
A client could include many structurally valid but unmapped SIDs in a DACL, causing ksmbd to log hundreds of error messages per request. The fix rate-limits the message.
Why it matters: An authenticated client could flood the kernel log with SID mapping errors.
CIFS client data-corruption fixes
Data corruption in emulated insert range via overlapping COPYCHUNK
smb3_insert_range() shifts data right using COPYCHUNK from low to high offsets, but when source and target ranges overlap, the copy overwrites source data before it is copied. For a 1 MiB insert at offset 0, this turns [A][B][C][D] into [hole][A][A][A][A]. The fix copies in server-allowed chunk sizes starting from the highest offset to avoid overwriting unread source data.
Why it matters: Insert-range fallocate on a CIFS mount could silently corrupt file contents.
Integer truncation in collapse range for large files
smb3_collapse_range() stored the ssize_t return of smb2_copychunk_range() in an int, so a successful copy larger than INT_MAX was truncated to a negative value and treated as an error. The fix uses __smb2_copychunk_range(), which reports success as zero instead of a byte count.
Why it matters: Collapse-range fallocate on files larger than 2 GiB would fail silently and leave the file unchanged.
Stale page cache after insert and collapse range
smb3_insert_range() and smb3_collapse_range() used truncate_pagecache_range() to invalidate page cache, but non-page-aligned boundaries left partial pages marked uptodate. After COPYCHUNK moved data on the server, those cached pages could return stale data. The fix ensures boundary pages are fully invalidated.
Why it matters: Reading a file after insert or collapse range on a CIFS mount could return stale cached data.
FS-Cache not invalidated after fallocate range operations
smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and smb3_collapse_range() discarded page cache but left the FS-Cache cookie valid, so a later read could return data cached before the range operation. The fix invalidates FS-Cache after outstanding I/O completes and before modifying the file on the server.
Why it matters: With fscache enabled, reads after fallocate operations could return pre-operation cached data.
Data corruption with concurrent writes and O_TRUNC
cifs_do_truncate() flushed dirty pages and truncated the server file without holding i_rwsem or invalidate_lock, so a concurrent buffered write could dirty new pages after the flush but before local truncation, and those pages would be silently discarded. The fix acquires exclusive i_rwsem and filemap_invalidate_lock for the entire flush-truncate-resize sequence.
Why it matters: A concurrent write during O_TRUNC on a CIFS mount could lose data silently.
Inode size set to zero when no cached handle is available during truncate
If find_writable_file() returned null, cifs_do_truncate would set i_size to zero before telling the server to truncate. If the subsequent O_TRUNC open failed, the inode had size zero while the server file was unchanged. The fix moves the size update into the branch where a writable file handle exists, and evicts stale pages before the open.
Why it matters: A failed open with O_TRUNC on CIFS could leave the local inode with a size of zero while the server file retained its data.
Stale inode metadata after FSCTL_DUPLICATE_EXTENTS_TO_FILE failure
smb2_duplicate_extents() had no handling for FSCTL failure: when the server-side duplicate extents operation failed, local inode metadata could be stale from pre-extension state or concurrent remote writes but was never refreshed. The fix forces revalidation on FSCTL failure.
Why it matters: After a failed server-side reflink copy on SMB3, the client could serve stale file size or metadata.
CIFS client security and limit validation fixes
Heap overflow in ACL set via mismatched size validation
cifs_set_acl() validated ACL size using the xattr format (4 + count*8 bytes), but cifs_do_set_acl() then wrote the larger CIFS wire format (6 + count*10 bytes) into the same buffer, causing a heap overflow. Additionally, the on-wire data_count is a __u16, so sizes above USHRT_MAX truncate the packet length and cause the server to apply a partial ACL. The fix validates the CIFS format size against remaining buffer space and USHRT_MAX before converting.
Why it matters: A crafted ACL could overflow a heap buffer in the CIFS client; a large valid ACL could also cause a partial ACL to be applied server-side.
SetEA requests not validated against request buffer size
CIFSSMBSetEA() copied the extended attribute value into the SMB request buffer without checking that it fit alongside the header and EA name. The only incoming bound was CIFSMaxBufSize (the full payload capacity), so a value of exactly that size left no room for the SMB header and overran the buffer. The fix rejects values that do not fit the negotiated buffer size.
Why it matters: Setting an xattr of maximum allowed size on a CIFS mount could overflow the request buffer.
RLIMIT_FSIZE bypass via insert range and zero range
smb3_insert_range() and smb3_zero_range() (without KEEP_SIZE) could extend the file beyond RLIMIT_FSIZE, s_maxbytes, or the loff_t range because they did not validate the new EOF before sending the server-side request. The fixes use check_add_overflow() and inode_newsize_ok() to validate the new size before modifying the file.
Why it matters: A process with an RLIMIT_FSIZE set could grow a CIFS file beyond that limit via fallocate.
Maintainership and other fixes
Steve French removed as maintainer; Paulo Alcantara added as SMBDIRECT co-maintainer
Steve French, long-time maintainer of Linux's SMB support, passed away. The KSMBD entry was updated to remove him, and Paulo Alcantara was added as a co-maintainer of SMBDIRECT.
Why it matters: Maintainership of SMBDIRECT transitions to Paulo Alcantara; KSMBD no longer lists Steve French.
Multiuser mount with krb5 fails to find credentials
The CIFS client was not duplicating the username option when creating multiuser connections with krb5, so cifs.upcall could not find credentials in the keytab. The fix duplicates the username option from the original fs context before creating multiuser connections.
Why it matters: Multiuser SMB mounts with krb5 authentication would fail to establish secondary sessions.
Emulated insert range does not mark file sparse first
The SMB client emulates FALLOC_FL_INSERT_RANGE with SET_EOF, COPYCHUNK, and SET_ZERO_DATA, but SET_ZERO_DATA only creates a hole on sparse files. On a non-sparse file, the inserted range was cleared but blocks remained allocated, causing extent-count checks to fail. The fix marks the file sparse before modifying it.
Why it matters: xfstests generic/064 fails on CIFS mounts where the server block size matches the deallocation granularity; real-world impact is sparse-extent metadata rather than data loss.
Debug print split across log levels in transport release
A prior printk-to-pr_level conversion accidentally split a single debug message into two messages on different log levels, confusing users in rare error cases. The fix restores the original single-message behavior.
Why it matters: Cosmetic; affects debug output readability in rare transport error paths.
Source commits26 entries +
cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()
Frank Sorenson · Aug 23, 2026 · 1 files
ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in
Aleksandr Khromov · Aug 24, 2026 · 1 files
ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION
Aleksandr Khromov · Aug 24, 2026 · 1 files
smb: client: fix multiuser mount with krb5
Paulo Alcantara · Aug 24, 2026 · 1 files
ksmbd: zero pipe read compound padding
Namjae Jeon · Aug 25, 2026 · 1 files
ksmbd: propagate DACL parsing errors
Namjae Jeon · Aug 25, 2026 · 1 files
ksmbd: rate limit unmapped SID errors
Namjae Jeon · Aug 25, 2026 · 1 files
ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION
Aleksandr Khromov · Aug 25, 2026 · 1 files
smb: client: transport: Fix debug printing in __release_mid()
Andy Shevchenko · Aug 25, 2026 · 1 files
MAINTAINERS: Add Paulo Alcantara as an SMBDIRECT co-maintainer
Namjae Jeon · Aug 26, 2026 · 1 files
MAINTAINERS: Update the KSMBD entry
Namjae Jeon · Aug 26, 2026 · 1 files
cifs: don't update i_size in cifs_do_truncate without a cached handle
Frank Sorenson · Aug 27, 2026 · 1 files
smb: client: fix heap overflow in cifs_do_set_acl()
Frank Sorenson · Aug 27, 2026 · 1 files
ksmbd: prevent out-of-bounds reads in share config responses
Namjae Jeon · Aug 27, 2026 · 2 files
ksmbd: fix listener task lifetime on netdev events
Namjae Jeon · Aug 28, 2026 · 1 files
ksmbd: safely drain sessions during logoff
Namjae Jeon · Aug 28, 2026 · 6 files
smb/client: validate new EOF for insert range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: validate new EOF for zero range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: mark file sparse before emulating insert range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: fix data corruption in emulated insert range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: fix integer truncation in collapse range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: fix stale page cache in insert/collapse range
Huiwen He · Aug 28, 2026 · 1 files
smb/client: invalidate fscache for fallocate range operations
Huiwen He · Aug 28, 2026 · 1 files
smb: client: fix data corruption with concurrent writes and O_TRUNC
Paulo Alcantara · Aug 28, 2026 · 1 files
ksmbd: validate normalized name response length
Alon Shakevsky · Aug 29, 2026 · 1 files
smb: client: reject SetEA requests that do not fit the request buffer
Yunpeng Tian · Aug 31, 2026 · 1 files