CVE-2026-43362

Description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix in-place encryption corruption in SMB2_write() SMB2_write() places write payload in iov[1..n] as part of rq_iov. smb3_init_transform_rq() pointer-shares rq_iov, so crypt_message() encrypts iov[1] in-place, replacing the original plaintext with ciphertext. On a replayable error, the retry sends the same iov[1] which now contains ciphertext instead of the original data, resulting in corruption. The corruption is most likely to be observed when connections are unstable, as reconnects trigger write retries that re-send the already-encrypted data. This affects SFU mknod, MF symlinks, etc. On kernels before 6.10 (prior to the netfs conversion), sync writes also used this path and were similarly affected. The async write path wasn't unaffected as it uses rq_iter which gets deep-copied. Fix by moving the write payload into rq_iter via iov_iter_kvec(), so smb3_init_transform_rq() deep-copies it before encryption.

CVSS Details

CVSS Score

8.1

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Linux Kernel < 6.10

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import os
import time
from smb.SMBConnection import SMBConnection

# Conceptual PoC for triggering the vulnerability
# This script attempts to write to an SMB share.
# To trigger the bug, network instability must be introduced (e.g., using tc to drop packets).
# The kernel will retry the write, sending corrupted (encrypted) data.

def trigger_corruption(username, password, client_name, server_name, domain, ip, share_name, file_path):
    try:
        conn = SMBConnection(username, password, client_name, server_name, domain=domain, use_ntlm_v2=True)
        conn.connect(ip, 139)
        
        # Simulating data that might be sensitive or structural (SFU mknod/symlink)
        data = b"Original Payload Data"
        
        with open(file_path, 'wb') as f:
            # Write operation that triggers SMB2_write
            # If network drops here, retry sends encrypted data
            conn.storeFile(share_name, os.path.basename(file_path), f)
            
        print("Write operation completed. Check server for corruption.")
        conn.close()
    except Exception as e:
        print(f"Error: {e}")

# Note: Actual exploitation requires unstable network conditions to force retries.

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43362
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43362
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43362/
[4] VulDB https://vuldb.com/cve/CVE-2026-43362
[5] https://git.kernel.org/stable/c/438e77435aee2894d5edf90be5c87004a57f6258
[6] https://git.kernel.org/stable/c/52327268224fb9ccc7ecfbbdfdfff54b6e93c518
[7] https://git.kernel.org/stable/c/92e64f1852f455f57d0850989e57c30d7fac7d95
[8] https://git.kernel.org/stable/c/aea5e37388a080361110ab5790f57ae0af383650
[9] https://git.kernel.org/stable/c/d78840a6a38d312dc1a51a65317bb67e46f0b929

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43362", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T15:16:47.133", "lastModified": "2026-05-11T08:16:11.150", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix in-place encryption corruption in SMB2_write()\n\nSMB2_write() places write payload in iov[1..n] as part of rq_iov.\nsmb3_init_transform_rq() pointer-shares rq_iov, so crypt_message()\nencrypts iov[1] in-place, replacing the original plaintext with\nciphertext. On a replayable error, the retry sends the same iov[1]\nwhich now contains ciphertext instead of the original data,\nresulting in corruption.\n\nThe corruption is most likely to be observed when connections are\nunstable, as reconnects trigger write retries that re-send the\nalready-encrypted data.\n\nThis affects SFU mknod, MF symlinks, etc. On kernels before\n6.10 (prior to the netfs conversion), sync writes also used\nthis path and were similarly affected. The async write path\nwasn't unaffected as it uses rq_iter which gets deep-copied.\n\nFix by moving the write payload into rq_iter via iov_iter_kvec(),\nso smb3_init_transform_rq() deep-copies it before encryption."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "references": [{"url": "https://git.kernel.org/stable/c/438e77435aee2894d5edf90be5c87004a57f6258", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/52327268224fb9ccc7ecfbbdfdfff54b6e93c518", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/92e64f1852f455f57d0850989e57c30d7fac7d95", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/aea5e37388a080361110ab5790f57ae0af383650", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d78840a6a38d312dc1a51a65317bb67e46f0b929", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}