CVE-2024-50286
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Slab-use-after-free vulnerability in the Linux kernel's ksmbd module in ksmbd_smb2_session_create. There is a race condition between this function and ksmbd_expire_session, requiring the addition of missing session table locking when adding/removing sessions from the global table.
Risk Assessment
May lead to memory corruption, system crash, or potential privilege escalation in kernel context.
Recommendation
Apply the Linux kernel update that includes the fix for this issue.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create There is a race condition between ksmbd_smb2_session_create and ksmbd_expire_session. This patch add missing sessions_table_lock while adding/deleting session from global session table.