CVE-2025-68806

The Linux kernel's ksmbd subsystem contains an off-by-one vulnerability in the smb2_set_ea function, which processes Extended Attributes (EA) for SMB2 protocol requests. The function's buffer validation incorrectly omitted the size of the null terminator for the EA name, leading to a mismatch between the expected and actual buffer size [1][2].

An attacker with the ability to send SMB2 requests to a system running ksmbd can exploit this by crafting a request with an EA name that exploits the off-by-one error. The vulnerability does not require authentication beyond standard SMB access, as EA operations are part of normal file operations.

If successfully exploited, the off-by-one error can cause a buffer overflow, potentially leading to memory corruption, system crash, or arbitrary code execution in kernel context, which could compromise the entire system.

The fix, which adds '+1' to the length check to account for the null terminator, has been backported to stable kernel trees [1][2]. Users are advised to apply the latest kernel updates to mitigate this vulnerability.