CVE-2023-38432
CriticalCVSS 9.1Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
An issue was discovered in the Linux kernel before 6.3.10 related to the validation of command payload size in ksmbd, leading to an out-of-bounds read.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized memory access, posing a risk of data leakage or system instability.
Recommendation
It is recommended to update the Linux kernel to version 6.3.10 or later to mitigate this vulnerability.
Other vulnerabilities in Linux kernel (ksmbd)
See all- CVE-2026-43376Critical
A vulnerability has been identified in the Linux kernel within ksmbd, related to a use-after-free error due to immediate freeing of the oplock_info structure. This issue occurs when the pointer is nullified without a grace period delay in RCU, allowing access to already freed memory.
- CVE-2023-54203Critical
In the Linux kernel, a vulnerability in the ksmbd module leads to a slab-out-of-bounds read in the init_smb2_rsp_hdr function. The issue occurs when an SMB1 mount attempt fails and the ksmbd server incorrectly handles SMB1 negotiation as an SMB2 operation, causing an out-of-bounds memory read.
- CVE-2023-38431Critical
An issue was discovered in the Linux kernel before 6.3.8 related to the lack of validation of the NetBIOS header's length in relation to SMB header sizes in ksmbd. This leads to an out-of-bounds read.
- CVE-2023-38427Critical
An issue was discovered in the Linux kernel before 6.3.8 related to integer underflow and out-of-bounds read in the deassemble_neg_contexts function in fs/smb/server/smb2pdu.c in ksmbd.
- CVE-2026-31432High
A vulnerability has been identified in the Linux kernel that allowed for out-of-bounds writes when processing compound requests in ksmbd. The issue occurred when the first command in a request consumed most of the response buffer, leading to errors in building the security descriptor.
Original NVD description (English source)
An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read.