Answer in brief
CVE-2026-43377 records a Unknown severity vulnerability in ksmbd: Don't log keys in SMB3 signing and encryption key generation. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <4084ed720d7d5f4e975c9e4a6267a552dad3b24a || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <fec5c70b82af3f59f15bb984df94e5ad1fccfb1e || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <3fe2d9ec166b7df9a8df6c0fdcfc210572e27e3f || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <407cc37c21d51f9b9d4d20204b04890880cfa6ae || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <c6b01b997a2094969e315f1ebfc1d64b8ae2163d || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <441336115df26b966575de56daf7107ed474faed | 4084ed720d7d5f4e975c9e4a6267a552dad3b24a, fec5c70b82af3f59f15bb984df94e5ad1fccfb1e, 3fe2d9ec166b7df9a8df6c0fdcfc210572e27e3f, 407cc37c21d51f9b9d4d20204b04890880cfa6ae, c6b01b997a2094969e315f1ebfc1d64b8ae2163d, 441336115df26b966575de56daf7107ed474faed |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
May 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Don't log keys in SMB3 signing and encryption key generation When KSMBD_DEBUG_AUTH logging is enabled, generate_smb3signingkey() and generate_smb3encryptionkey() log the session, signing, encryption, and decryption key bytes. Remove the logs to avoid exposing credentials.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-43377 records a Unknown severity vulnerability in ksmbd: Don't log keys in SMB3 signing and encryption key generation. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <4084ed720d7d5f4e975c9e4a6267a552dad3b24a || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <fec5c70b82af3f59f15bb984df94e5ad1fccfb1e || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <3fe2d9ec166b7df9a8df6c0fdcfc210572e27e3f || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <407cc37c21d51f9b9d4d20204b04890880cfa6ae || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <c6b01b997a2094969e315f1ebfc1d64b8ae2163d || >=e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 <441336115df26b966575de56daf7107ed474faed | 4084ed720d7d5f4e975c9e4a6267a552dad3b24a, fec5c70b82af3f59f15bb984df94e5ad1fccfb1e, 3fe2d9ec166b7df9a8df6c0fdcfc210572e27e3f, 407cc37c21d51f9b9d4d20204b04890880cfa6ae, c6b01b997a2094969e315f1ebfc1d64b8ae2163d, 441336115df26b966575de56daf7107ed474faed |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
May 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Don't log keys in SMB3 signing and encryption key generation When KSMBD_DEBUG_AUTH logging is enabled, generate_smb3signingkey() and generate_smb3encryptionkey() log the session, signing, encryption, and decryption key bytes. Remove the logs to avoid exposing credentials.
Quoted source text, attributed separately from HOL analysis.