What’s Vulnerable › Vulnerabilities

CVE-2024-26594: ksmbd: validate mech token in session setup

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 51.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-23 · updated 2026-08-04
• Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid.

Affected products

• Linux kernel: before 5.15.149; from 5.16.0 before 6.1.75; from 6.2.0 before 6.6.14; from 6.7.0 before 6.7.2 — fixed in 5.15.149, 6.1.75, 6.6.14, 6.7.2

How to fix

Upgrade to a fixed version: Linux kernel 5.15.149, 6.1.75, 6.6.14, 6.7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/5e6dfec95833edc54c48605a98365a7325e5541e
• https://git.kernel.org/stable/c/6eb8015492bcc84e40646390e50a862b2c0529c9
• https://git.kernel.org/stable/c/92e470163d96df8db6c4fa0f484e4a229edb903d
• https://git.kernel.org/stable/c/a2b21ef1ea4cf632d19b3a7cc4d4245b8e63202a
• https://git.kernel.org/stable/c/dd1de9268745f0eac83a430db7afc32cbd62e84b
• https://git.kernel.org/stable/c/5e6dfec95833edc54c48605a98365a7325e5541e
• https://git.kernel.org/stable/c/6eb8015492bcc84e40646390e50a862b2c0529c9
• https://git.kernel.org/stable/c/92e470163d96df8db6c4fa0f484e4a229edb903d
• https://git.kernel.org/stable/c/a2b21ef1ea4cf632d19b3a7cc4d4245b8e63202a
• https://git.kernel.org/stable/c/dd1de9268745f0eac83a430db7afc32cbd62e84b

Get alerted when CVE-2024-26594 or the next vulnerability affects your stack