PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43377 Git CVE debrief

CVE-2026-43377 is a high-severity Linux kernel ksmbd issue where debug authentication logging can leak sensitive SMB3 key material into logs. According to the CVE description, the affected functions logged session, signing, encryption, and decryption key bytes when KSMBD_DEBUG_AUTH was enabled; the fix removes those logs. Because the exposure is in authentication and encryption material, any environment with the debug option enabled should treat this as a confidentiality incident risk.

Vendor
Git
Product
Unknown
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-11
Advisory published
2026-05-08
Advisory updated
2026-05-11

Who should care

Linux kernel and distro maintainers, SMB server operators using ksmbd, and anyone running kernels with KSMBD_DEBUG_AUTH enabled. Systems that centralize or widely expose logs should treat this as especially important.

Technical summary

When KSMBD_DEBUG_AUTH logging is enabled, generate_smb3signingkey() and generate_smb3encryptionkey() can write sensitive key bytes to logs. The CVE description says the leaked material includes the session, signing, encryption, and decryption keys, which can expose credentials and undermine SMB3 session protection. The remediation is to remove the logging of these secrets.

Defensive priority

High. This is a direct secret-disclosure flaw involving cryptographic key material, with network reach and potential impact on confidentiality and integrity of SMB sessions.

Recommended defensive actions

  • Apply the kernel update or stable backport that includes the official fix referenced by the kernel.org links.
  • Disable KSMBD_DEBUG_AUTH and other verbose authentication debugging in production environments.
  • Restrict access to kernel and service logs; treat any logs produced while the debug option was enabled as sensitive.
  • If exposure is suspected, rotate affected SMB credentials and keys and review logs for leaked key bytes.
  • Verify that all ksmbd deployments, including backported stable kernels, are patched.

Evidence notes

The supplied CVE description states that KSMBD_DEBUG_AUTH logging caused generate_smb3signingkey() and generate_smb3encryptionkey() to log session, signing, encryption, and decryption key bytes, and that the fix removes the logs. The NVD record lists official kernel.org stable references for the remediation. Published 2026-05-08 and modified 2026-05-11. Supplied CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (8.1 HIGH).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43377 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43377

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43377 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43377

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3fe2d9ec166b7df9a8df6c0fdcfc210572e27e3f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/407cc37c21d51f9b9d4d20204b04890880cfa6ae

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4084ed720d7d5f4e975c9e4a6267a552dad3b24a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/441336115df26b966575de56daf7107ed474faed

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c6b01b997a2094969e315f1ebfc1d64b8ae2163d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fec5c70b82af3f59f15bb984df94e5ad1fccfb1e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.