The Linux kernel's ksmbd component had a path resolution vulnerability in the function ksmbd_vfs_kern_path_create. While SMB2 open lookups were correctly rooted at the share with LOOKUP_BENEATH, the create, mkdir, and hardlink operations were not. The vulnerable code built an absolute path and resolved it from the filesystem root (AT_FDCWD), allowing '..' path components to escape the share export. An authenticated client could race a missing path component, causing the create operation to resolve outside the share boundary. The fix changes the create walk to be rooted at the share like the lookup and rename paths, using vfs_path_parent_lookup with LOOKUP_BENEATH and start_creating_noperm, eliminating the vulnerable path resolution method.

An authenticated client could exploit this vulnerability to escape the intended SMB share export boundaries by traversing '..' components outside the share. This could lead to unauthorized access or modification of files outside the share. The vulnerability affects the Linux kernel's ksmbd SMB server implementation. No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by rooting the create walk at the share and removing the vulnerable path resolution code. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.