What’s Vulnerable › Vulnerabilities

CVE-2023-4515: ksmbd: validate command request size

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-16 · updated 2026-08-04

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands.

Affected products

• Linux kernel: from 5.15.121 before 5.15.127; from 6.1.36 before 6.1.46; from 6.3.10 before 6.4; from 6.4.1 before 6.4.11; 6.4, 6.5-rc1, 6.5-rc2, 6.5-rc3, 6.5-rc4, 6.5-rc5 — fixed in 5.15.127, 6.1.46, 6.4, 6.4.11

How to fix

Upgrade to a fixed version: Linux kernel 5.15.127, 6.1.46, 6.4, 6.4.11. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/595679098bdcdbfbba91ebe07a2f7f208df93870
• https://git.kernel.org/stable/c/5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c
• https://git.kernel.org/stable/c/c6bef3bc30fd4a175aef846b7d928a6c40d091cd
• https://git.kernel.org/stable/c/ff7236b66d69582f90cf5616e63cfc3dc18142bb

Get alerted when CVE-2023-4515 or the next vulnerability affects your stack