Vulnerability feed

Executive summary

The advisory describes a heap out-of-bounds write in the ksmbd component of the Linux kernel, reached through Kerberos session setup in compounded SMB2 requests. The advisory does not state a severity rating or a CVSS score. The fix is a one-line kernel patch that corrects the buffer-space calculation.

Technical summary

The flaw is a heap out-of-bounds write (CWE class not named, but described as memcpy writing past the end of response_buf) in krb5_authenticate() in fs/smb/server/smb2pdu.c. It occurs when SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, because the out_len calculation omits work->next_smb2_rsp_hdr_off, overstating remaining buffer space. The advisory does not state the attack vector in detail, the authentication requirements, or the affected kernel version ranges. The fix subtracts work->next_smb2_rsp_hdr_off from out_len, and the advisory references commit 23a0be6a84a38ac169eeab49017934e8e27c65f0. No workaround, detection guidance, or exploitation status is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/23a0be6a84a38ac…ab49017934e8e27c65f0

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxLinuxLinux kernelLinux ksmbd

Executive summary

This advisory describes a fix in the Linux kernel's ksmbd file server component, where a lease break could stall for about 35 seconds while holding a lock that the close path needed. The advisory does not state a severity rating or any exploitation details; it describes the change as a performance and correctness fix for lease handling. The stated remedy is the kernel patch that releases the lock before waiting for the break acknowledgment.

Technical summary

The flaw is a locking problem in ksmbd, the in-kernel SMB server, where __smb_break_all_levII_oplock() waited for a lease break acknowledgment while holding ci->m_lock for read, blocking the close path that would have woken the waiter. The break was then resolved only by a 35 second timeout, which the advisory connects to a slowed xfstests generic/001 run (about 78 seconds with leases versus about 4 seconds with oplocks only). The fix collects target opinfos with references under the lock and breaks them after releasing it, and applies the same change to the parent lease break paths. The advisory does not state a CVSS score, a CWE, attack vector or required privileges, affected kernel version ranges, fixed version numbers, workarounds, or any detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/27a9bc968d4ae80…ca2f2b136856ee613cb4

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernelLinux ksmbd

Executive summary

The advisory describes a flaw in the Linux kernel's ksmbd SMB server component that can leave stale channel and session data behind when a connection disconnects. The advisory does not state a severity score, and the text shown does not describe an available attack vector beyond the code path, so the risk level is not stated. The fix is a kernel patch that removes the gating condition so channels are always cleaned up on teardown.

Technical summary

The flaw is a use-after-free write in ksmbd, the in-kernel SMB server, where a stale channel still points to a freed ksmbd_conn structure after the connection tears down. ksmbd_sessions_deregister() only removed a connection's channels from other sessions while conn->binding was set, but that flag can be cleared by a later non-binding SESSION_SETUP on the same connection. The fix removes the conn->binding check so channels are always removed from every session on teardown, and the advisory says the stale channel is also walked through /proc, and that the session can leak. The advisory does not state affected or fixed version numbers beyond the referenced upstream commit, does not state a CVSS score, does not describe attacker preconditions in terms of authentication or network reach, and does not give workarounds or detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/9cd6d714d3ca0cf…42dc989696884e41970f

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxLinuxLinux kernelLinux ksmbd