What’s Vulnerable › Vulnerabilities

CVE-2024-26592: ksmbd: fix UAF issue in ksmbd_tcp_new_connection()

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-22 · updated 2026-08-04
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on `struct tcp_transport` in ksmbd_tcp_new_connection() function.

Affected products

• Linux kernel: from 5.15.0 before 5.15.149; from 5.16.0 before 6.1.75; from 6.2.0 before 6.6.14; from 6.7.0 before 6.7.2 — fixed in 5.15.149, 6.1.75, 6.6.14, 6.7.2

How to fix

Upgrade to a fixed version: Linux kernel 5.15.149, 6.1.75, 6.6.14, 6.7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/24290ba94cd0136e417283b0dbf8fcdabcf62111
• https://git.kernel.org/stable/c/380965e48e9c32ee4263c023e1d830ea7e462ed1
• https://git.kernel.org/stable/c/38d20c62903d669693a1869aa68c4dd5674e2544
• https://git.kernel.org/stable/c/69d54650b751532d1e1613a4fb433e591aeef126
• https://git.kernel.org/stable/c/999daf367b924fdf14e9d83e034ee0f86bc17ec6
• https://git.kernel.org/stable/c/24290ba94cd0136e417283b0dbf8fcdabcf62111
• https://git.kernel.org/stable/c/380965e48e9c32ee4263c023e1d830ea7e462ed1
• https://git.kernel.org/stable/c/38d20c62903d669693a1869aa68c4dd5674e2544
• https://git.kernel.org/stable/c/69d54650b751532d1e1613a4fb433e591aeef126
• https://git.kernel.org/stable/c/999daf367b924fdf14e9d83e034ee0f86bc17ec6

Get alerted when CVE-2024-26592 or the next vulnerability affects your stack