CVE-2023-38428

CriticalCVSS 9.1

Published: 18/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.98%

85th percentile - higher than 85% of all known CVEs

Summary

An issue was discovered in the Linux kernel before version 6.3.4 in fs/ksmbd/smb2pdu.c, which does not properly check the UserName value. This leads to an out-of-bounds read.

Risk Assessment

Organizations may be exposed to unauthorized access to data, potentially leading to serious security breaches.

Recommendation

It is recommended to update the Linux kernel to version 6.3.4 or later to mitigate this vulnerability.

Original NVD description (English source)

An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read.