CVE-2026-43377 HIGH

CVE-2026-43377: ksmbd: Don't log keys in SMB3 signing and encryption key generation

Vendor Linux
Product Linux
Published May 8, 2026
Last update May 11, 2026
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Don't log keys in SMB3 signing and encryption key generation When KSMBD_DEBUG_AUTH logging is enabled, generate_smb3signingkey() and generate_smb3encryptionkey() log the session, signing, encryption, and decryption key bytes. Remove the logs to avoid exposing credentials.

Key dates

02Disclosure timeline

May 8, 2026 CVE published
May 11, 2026 Record updated