Riskcovery

CVE-2024-50283

ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp

State
Published
Severity
9.8 Critical
Published
Nov 19, 2024
Updated
Aug 5, 2026
Reserved
Oct 21, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp

ksmbd_user_session_put should be called under smb3_preauth_hash_rsp(). It will avoid freeing session before calling smb3_preauth_hash_rsp().

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before cb645064e0811053c94e86677f2e58ed29359d62Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before f7557bbca40d4ca8bb1c6c940ac6c95078bd0827Affected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before c6cdc08c25a868a08068dfc319fa9fce982b8e7fAffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before 1b6ad475d4ed577d34e0157eb507be00c588bf5cAffected
  • 0626e6641f6b467447c81dd7678a69c66f7746cf to before b8fc56fbca7482c1e5c0e3351c6ae78982e25adaAffected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 5.15.174 through 5.15.*Not affected
  • 6.1.117 through 6.1.*Not affected
  • 6.6.61 through 6.6.*Not affected
  • 6.11.8 through 6.11.*Not affected
  • 6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.