A critical vulnerability in the Linux kernel ksmbd module allows unauthenticated remote attackers to perform unauthorized file I/O, potentially leading to full system compromise.

The ksmbd implementation incorrectly uses current task credentials instead of the opener's credentials when performing Alternate Data Stream (ADS) read and write operations. Because ADS access relies on VFS xattr helpers that recheck permissions, this flaw permits an unauthenticated attacker to bypass intended access controls.

The CVSS score of 9.8 reflects the high risk posed by this vulnerability, as it allows unauthenticated remote code execution or unauthorized data access without requiring user interaction. Successful exploitation could result in complete loss of confidentiality, integrity, and availability for systems running the ksmbd server, posing a severe threat to enterprise data security and operational continuity.

Immediate Action: Update the Linux kernel to version 6.12.96, 6.18.39, 7.1.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unusual SMB traffic patterns or unexpected xattr modification attempts that deviate from established baseline behavior.

Compensating Controls: If immediate patching is not possible, consider disabling the ksmbd kernel module or restricting access to the SMB service via network firewalls to trusted internal segments only.

Public Exploit Available: No (exploit_available: false)

Given the critical severity and the potential for unauthenticated remote exploitation, organizations should prioritize patching their Linux kernels immediately. Verify that the updated versions are deployed across all production environments and ensure that kernel hardening measures are in place to limit the impact of potential future kernel-level vulnerabilities.