Ksmbd
Monthly
A use-after-free race condition in the Linux kernel's ksmbd in-kernel SMB3 server can crash the kernel (denial of service) when a session is torn down while multiple channels are bound to a session and deferred byte-range locks or pending CANCELs remain counted as running requests. Affected systems must have ksmbd enabled (CONFIG_SMB_SERVER) and exporting at least one SMB3 share, and an authenticated remote attacker (PR:L) must negotiate SMB3 multichannel to race a LOGOFF, synchronous CANCEL, or abrupt connection teardown against still-running requests; success is non-deterministic (AC:H). No public exploit code has been identified at time of analysis, and the impact is availability loss, not information disclosure or confidentiality/integrity compromise as some tags or the base CVSS may imply.
Use-after-free race in the Linux kernel's ksmbd SMB3 server can be triggered when a network-device event such as an interface up/down operation invokes ksmbd's netdevice notifier during listener teardown, potentially allowing a local actor who can induce netdev events to corrupt memory and cause denial of service. Affected systems are those with CONFIG_SMB_SERVER enabled and at least one ksmbd listener bound to a network interface; hosts using userspace Samba instead of ksmbd are not affected. No CISA KEV entry or public exploit code was provided, and no public exploit identified at time of analysis; the assessed vector is local, high complexity, PR:L, C:N/I:L/A:H, so the NVD 7.8 vector overstates confidentiality and integrity risk, while vendor-released fixes are available in Linux 7.2.7 and 7.3-rc2.
Mandatory byte-range lock enforcement is bypassed in the Linux kernel's in-kernel ksmbd SMB server, letting a client with a valid authenticated SMB session (CVSS PR:L) perform single-byte reads, writes, copychunk operations, and one-byte truncates against a byte that another client has already locked with a conflicting mandatory lock. The defect is a range-validation logic error: check_lock_range() uses inclusive ranges and its callers pass start + length - 1 as the end offset, so the start == end shortcut incorrectly treated a legitimate one-byte range as empty and skipped the lock check entirely; multi-byte ranges were always checked correctly. Exploitation requires a non-default configuration (CONFIG_SMB_SERVER enabled with an exported share) and a pre-existing conflicting lock, which sharply limits real-world exposure; no public exploit code has been identified at time of analysis, and the vendor CVSS of 8.1 (C:H/I:H) overstates impact relative to our assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
The Linux kernel's in-kernel SMB server, ksmbd (CONFIG_SMB_SERVER), can be driven to read up to 65535 bytes past the end of a fixed-size hash buffer during NTLM authentication, producing a KASAN-confirmed slab-out-of-bounds read and a kernel crash (denial of service) with only partial adjacent-memory disclosure. Exploitation is not achieved with a plain remote SMB packet: the oversized hash_sz value arrives in the mountd IPC login response delivered over the ksmbd generic-netlink family, so the attacker must control, spoof, or compromise that privileged userspace-to-kernel channel (normally the ksmbd.mountd daemon, reachable with CAP_NET_ADMIN-class access), which is why the assessed vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H rather than a network-vector issue. ksmbd is a non-default, opt-in feature, which materially narrows the exposed population, and no public exploit code was identified at time of analysis.
Kernel memory corruption in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client trigger a use-after-free and double-free by racing a multi-element SMB2_LOCK batch against a concurrent UNLOCK on the same connection. The granting thread publishes mid-batch locks to the connection-wide and file-wide lock lists before the batch completes; when a later element fails, rollback walks a request-local list whose entry a concurrent UNLOCK has already kfree()'d, so both the ksmbd_lock and its struct file_lock are freed twice. The vendor rates this CVSS 3.1 8.8, but our assessment keeps AC:H because exploitation requires a narrow timing window and ksmbd is off by default on most distributions; no public exploit code and no confirmed active exploitation were identified at time of analysis, and authentication as a valid SMB user (PR:L) is a hard prerequisite.
Heap out-of-bounds read and subsequent heap corruption in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated remote SMB client with directory-creation rights corrupt kernel memory through the ACL inheritance path. By writing a crafted DACL whose SID carries an inflated num_subauth field and then creating child entries, an attacker can crash the kernel (DoS) or potentially escalate to kernel code execution. No public exploit identified at time of analysis; EPSS is low (0.18%, 39th percentile) and the flaw is not in CISA KEV, so exploitation is not confirmed in the wild.
The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has been enabled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A use-after-free race condition in the Linux kernel's ksmbd in-kernel SMB3 server can crash the kernel (denial of service) when a session is torn down while multiple channels are bound to a session and deferred byte-range locks or pending CANCELs remain counted as running requests. Affected systems must have ksmbd enabled (CONFIG_SMB_SERVER) and exporting at least one SMB3 share, and an authenticated remote attacker (PR:L) must negotiate SMB3 multichannel to race a LOGOFF, synchronous CANCEL, or abrupt connection teardown against still-running requests; success is non-deterministic (AC:H). No public exploit code has been identified at time of analysis, and the impact is availability loss, not information disclosure or confidentiality/integrity compromise as some tags or the base CVSS may imply.
Use-after-free race in the Linux kernel's ksmbd SMB3 server can be triggered when a network-device event such as an interface up/down operation invokes ksmbd's netdevice notifier during listener teardown, potentially allowing a local actor who can induce netdev events to corrupt memory and cause denial of service. Affected systems are those with CONFIG_SMB_SERVER enabled and at least one ksmbd listener bound to a network interface; hosts using userspace Samba instead of ksmbd are not affected. No CISA KEV entry or public exploit code was provided, and no public exploit identified at time of analysis; the assessed vector is local, high complexity, PR:L, C:N/I:L/A:H, so the NVD 7.8 vector overstates confidentiality and integrity risk, while vendor-released fixes are available in Linux 7.2.7 and 7.3-rc2.
Mandatory byte-range lock enforcement is bypassed in the Linux kernel's in-kernel ksmbd SMB server, letting a client with a valid authenticated SMB session (CVSS PR:L) perform single-byte reads, writes, copychunk operations, and one-byte truncates against a byte that another client has already locked with a conflicting mandatory lock. The defect is a range-validation logic error: check_lock_range() uses inclusive ranges and its callers pass start + length - 1 as the end offset, so the start == end shortcut incorrectly treated a legitimate one-byte range as empty and skipped the lock check entirely; multi-byte ranges were always checked correctly. Exploitation requires a non-default configuration (CONFIG_SMB_SERVER enabled with an exported share) and a pre-existing conflicting lock, which sharply limits real-world exposure; no public exploit code has been identified at time of analysis, and the vendor CVSS of 8.1 (C:H/I:H) overstates impact relative to our assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.
The Linux kernel's in-kernel SMB server, ksmbd (CONFIG_SMB_SERVER), can be driven to read up to 65535 bytes past the end of a fixed-size hash buffer during NTLM authentication, producing a KASAN-confirmed slab-out-of-bounds read and a kernel crash (denial of service) with only partial adjacent-memory disclosure. Exploitation is not achieved with a plain remote SMB packet: the oversized hash_sz value arrives in the mountd IPC login response delivered over the ksmbd generic-netlink family, so the attacker must control, spoof, or compromise that privileged userspace-to-kernel channel (normally the ksmbd.mountd daemon, reachable with CAP_NET_ADMIN-class access), which is why the assessed vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H rather than a network-vector issue. ksmbd is a non-default, opt-in feature, which materially narrows the exposed population, and no public exploit code was identified at time of analysis.
Kernel memory corruption in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client trigger a use-after-free and double-free by racing a multi-element SMB2_LOCK batch against a concurrent UNLOCK on the same connection. The granting thread publishes mid-batch locks to the connection-wide and file-wide lock lists before the batch completes; when a later element fails, rollback walks a request-local list whose entry a concurrent UNLOCK has already kfree()'d, so both the ksmbd_lock and its struct file_lock are freed twice. The vendor rates this CVSS 3.1 8.8, but our assessment keeps AC:H because exploitation requires a narrow timing window and ksmbd is off by default on most distributions; no public exploit code and no confirmed active exploitation were identified at time of analysis, and authentication as a valid SMB user (PR:L) is a hard prerequisite.
Heap out-of-bounds read and subsequent heap corruption in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated remote SMB client with directory-creation rights corrupt kernel memory through the ACL inheritance path. By writing a crafted DACL whose SID carries an inflated num_subauth field and then creating child entries, an attacker can crash the kernel (DoS) or potentially escalate to kernel code execution. No public exploit identified at time of analysis; EPSS is low (0.18%, 39th percentile) and the flaw is not in CISA KEV, so exploitation is not confirmed in the wild.
The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has been enabled. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.