CVE-2026-68083

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix path resolution in ksmbd_vfs_kern_path_create<br /> <br /> The SMB2 open lookup is rooted at the share with LOOKUP_BENEATH, but the<br /> create/mkdir/hardlink sink is not: ksmbd_vfs_kern_path_create() builds an<br /> absolute path with convert_to_unix_name() and resolves it from AT_FDCWD<br /> via start_creating_path(), so a ".." component is walked from the real<br /> filesystem root and escapes the export.<br /> <br /> An authenticated client races a missing path component so the rooted open<br /> lookup returns -ENOENT (taking the create branch) while the same component<br /> is present (a directory) when the create walk runs; the create then<br /> resolves ".." out of the share.<br /> <br /> Root the create walk at the share like the lookup and rename paths already<br /> are: resolve the parent with vfs_path_parent_lookup(..., LOOKUP_BENEATH,<br /> &amp;share_conf-&gt;vfs_path) and create the final component with<br /> start_creating_noperm(). convert_to_unix_name() then has no callers and is<br /> removed.