Riskcovery

CVE-2024-26594

ksmbd: validate mech token in session setup

State
Published
Severity
9.1 Critical
Published
Feb 23, 2024
Updated
Aug 5, 2026
Reserved
Feb 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate mech token in session setup

If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before dd1de9268745f0eac83a430db7afc32cbd62e84bAffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 6eb8015492bcc84e40646390e50a862b2c0529c9Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before a2b21ef1ea4cf632d19b3a7cc4d4245b8e63202aAffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 5e6dfec95833edc54c48605a98365a7325e5541eAffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 92e470163d96df8db6c4fa0f484e4a229edb903dAffected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 5.15.149 through 5.15.*Not affected
  • 6.1.75 through 6.1.*Not affected
  • 6.6.14 through 6.6.*Not affected
  • 6.7.2 through 6.7.*Not affected
  • 6.8 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.