CVE-2023-32249

CriticalCVSS 9.1

Published: 16/08/2025(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

In the Linux kernel, the ksmbd module now prevents guest users from using multichannel. If a session is bound to a guest, the server returns STATUS_NOT_SUPPORTED.

Risk Assessment

Without this fix, unauthenticated users could potentially use multiple channels, increasing the risk of unauthorized access to SMB resources.

Recommendation

Update the Linux kernel to a version containing the fix for CVE-2023-32249 to prevent guest sessions from using multichannel.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: not allow guest user on multichannel This patch return STATUS_NOT_SUPPORTED if binding session is guest.