The Linux kernel's ksmbd_vfs_path_lookup() function enforces LOOKUP_BENEATH to restrict path resolution within the share root, preventing escape via '..' components. However, in __ksmbd_vfs_kern_path() under caseless mode, the function incorrectly ignores the -EXDEV error returned by vfs_path_parent_lookup() and proceeds to caseless retry logic meant only for missing files (-ENOENT). This retry reconstructs the path and bypasses LOOKUP_BENEATH, allowing write-capable users to create zero-length files or directories outside the exported share. The fix ensures that only -ENOENT errors trigger the retry, while other errors like -EXDEV are returned immediately, preventing the bypass.

This vulnerability allows users with write permissions to create files or directories outside the intended share boundary, potentially leading to unauthorized file system modifications outside the exported share. There is no indication of remote code execution or privilege escalation beyond this scope.

A fix has been implemented in the Linux kernel to address this vulnerability by correcting error handling in the ksmbd caseless path lookup logic. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not yet confirmed in this data; check the vendor or Linux kernel advisories for the current remediation guidance.