CVE-2024-26980

ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf

State: Published
Severity: 8.2 High
Published: May 1, 2024
Updated: Aug 5, 2026
Reserved: Feb 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf

If ->ProtocolId is SMB2_TRANSFORM_PROTO_NUM, smb2 request size validation could be skipped. if request size is smaller than sizeof(struct smb2_query_info_req), slab-out-of-bounds read can happen in smb2_allocate_rsp_buf(). This patch allocate response buffer after decrypting transform request. smb3_decrypt_req() will validate transform request size and avoid slab-out-of-bound in smb2_allocate_rsp_buf().

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0626e6641f6b467447c81dd7678a69c66f7746cf to before da21401372607c49972ea87a6edaafb36a17c325Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before b80ba648714e6d790d69610cf14656be222d0248Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 3160d9734453a40db248487f8204830879c207f1Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 0977f89722eceba165700ea384f075143f012085Affected 0626e6641f6b467447c81dd7678a69c66f7746cf to before c119f4ede3fa90a9463f50831761c28f989bfb20Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.159 through 5.15.Not affected 6.1.88 through 6.1.Not affected 6.6.29 through 6.6.Not affected 6.8.8 through 6.8.Not affected 6.9 and laterNot affected

Product

Versions

LinuxLinux

0626e6641f6b467447c81dd7678a69c66f7746cf to before da21401372607c49972ea87a6edaafb36a17c325Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before b80ba648714e6d790d69610cf14656be222d0248Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 3160d9734453a40db248487f8204830879c207f1Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 0977f89722eceba165700ea384f075143f012085Affected
0626e6641f6b467447c81dd7678a69c66f7746cf to before c119f4ede3fa90a9463f50831761c28f989bfb20Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.159 through 5.15.*Not affected
6.1.88 through 6.1.*Not affected
6.6.29 through 6.6.*Not affected
6.8.8 through 6.8.*Not affected
6.9 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.