CVE-2024-58087

ksmbd: fix racy issue from session lookup and expire

State: Published
Severity: 9.8 Critical
Published: Mar 12, 2025
Updated: Aug 5, 2026
Reserved: Mar 6, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix racy issue from session lookup and expire

Increment the session reference count within the lock for lookup to avoid racy issue with session expire.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-667 Improper Locking

Affected Products

Product	Versions
LinuxLinux	0626e6641f6b467447c81dd7678a69c66f7746cf to before 2107ab40629aeabbec369cf34b8cf0f288c3eb1bAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 37a0e2b362b3150317fb6e2139de67b1e29ae5ffAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before 450a844c045ff0895d41b05a1cbe8febd1acfcfdAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before a39e31e22a535d47b14656a7d6a893c7f6cf758cAffected 0626e6641f6b467447c81dd7678a69c66f7746cf to before b95629435b84b9ecc0c765995204a4d8a913ed52Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.15.176 through 5.15.Not affected 6.1.121 through 6.1.Not affected 6.6.67 through 6.6.Not affected 6.12.6 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

0626e6641f6b467447c81dd7678a69c66f7746cf to before 2107ab40629aeabbec369cf34b8cf0f288c3eb1bAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 37a0e2b362b3150317fb6e2139de67b1e29ae5ffAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before 450a844c045ff0895d41b05a1cbe8febd1acfcfdAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before a39e31e22a535d47b14656a7d6a893c7f6cf758cAffected
0626e6641f6b467447c81dd7678a69c66f7746cf to before b95629435b84b9ecc0c765995204a4d8a913ed52Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.15.176 through 5.15.*Not affected
6.1.121 through 6.1.*Not affected
6.6.67 through 6.6.*Not affected
6.12.6 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.