Linux Kernel
CVE-2024-26980
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Network-reachable SMB port, no auth required at transform parsing stage, slab read leaks kernel memory (C:L), crash achievable (A:H), no integrity impact.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
If ->ProtocolId is SMB2_TRANSFORM_PROTO_NUM, smb2 request size validation could be skipped. if request size is smaller than sizeof(struct smb2_query_info_req), slab-out-of-bounds read can happen in smb2_allocate_rsp_buf(). This patch allocate response buffer after decrypting transform request. smb3_decrypt_req() will validate transform request size and avoid slab-out-of-bound in smb2_allocate_rsp_buf().
AnalysisAI
Slab-out-of-bounds read in the Linux kernel's ksmbd SMB server subsystem allows a remote unauthenticated attacker to cause a kernel crash (availability impact) and leak kernel slab memory contents (limited confidentiality impact) by sending a crafted SMB2 TRANSFORM packet smaller than sizeof(struct smb2_query_info_req). The flaw stems from ksmbd bypassing request size validation when the ProtocolId field equals SMB2_TRANSFORM_PROTO_NUM, which is the encrypted-session header type for SMB3. No active exploitation confirmed (not in CISA KEV) and EPSS sits at 0.23% (13th percentile), but the network-accessible, pre-authentication attack surface warrants patching on any host running ksmbd.
Technical ContextAI
ksmbd is the in-kernel SMB3 server module introduced in Linux 5.15, providing SMB2/SMB3 file sharing without a userspace daemon. The vulnerable function smb2_allocate_rsp_buf() allocates the response buffer based on SMB2 command type, but before this patch it ran before decryption and size validation for SMB2_TRANSFORM_PROTO_NUM (0xFD534D42) packets. CWE-125 (Out-of-bounds Read) applies: when the incoming packet is shorter than struct smb2_query_info_req, the function reads beyond the allocated slab object boundary. The fix reorders processing so smb3_decrypt_req() - which validates the transform request size - is called first, blocking the malformed packet before smb2_allocate_rsp_buf() is reached. Affected CPEs span multiple Linux kernel release series as confirmed by the five backport commits across stable trees (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* and explicitly 6.9:rc1 through 6.9:rc5).
RemediationAI
Apply the upstream stable-tree patches available at kernel.org: commits 0977f89722ec, 3160d9734453, b80ba648714e, c119f4ede3fa, and da21401372607, all referenced in the NVD patch links. Fedora users should apply the kernel updates announced in the Fedora package-announce list (see https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/ and the related messages). If patching is not immediately possible, the most effective compensating control is to stop and disable the ksmbd module (rmmod ksmbd; echo 'blacklist ksmbd' > /etc/modprobe.d/ksmbd-blacklist.conf), eliminating the attack surface entirely - trade-off is loss of kernel-native SMB serving, which can be replaced by Samba userspace if needed. Alternatively, restrict TCP 445 access to trusted source IPs via firewall rules to limit exposure; this reduces but does not eliminate risk if an attacker already has network access.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today