What’s Vulnerable › Vulnerabilities

CVE-2024-22705

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-01-23 · updated 2026-06-17
• Weakness: CWE-125

Description

An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled.

Affected products

• Linux kernel: before 6.6.10; 6.7-rc1, 6.7-rc2, 6.7-rc3, 6.7-rc4, 6.7-rc5, 6.7-rc6 (+1) — fixed in 6.6.10

How to fix

Upgrade to a fixed version: Linux kernel 6.6.10. Check the vendor advisory for mitigations.

References

• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.10
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d10c77873ba1e9e6b91905018e29e196fd5f863d
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.10
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d10c77873ba1e9e6b91905018e29e196fd5f863d

Get alerted when CVE-2024-22705 or the next vulnerability affects your stack