Loading story…
The Linux kernel project disclosed and fixed two vulnerabilities in ksmbd, the in-kernel SMB server, tracked as CVE-2024-50283 and CVE-2024-50286. Both issues were identified as slab use-after-free bugs, a memory-safety flaw class that can lead to kernel crashes, memory corruption, or potentially code execution in privileged context if successfully exploited.
The first flaw, CVE-2024-50283, affects smb3_preauth_hash_rsp, while CVE-2024-50286 affects ksmbd_smb2_session_create. Both vulnerable paths are tied to SMB3 authentication and session establishment, placing the exposure in network-facing code used to process client connections. The fixes were published through the Linux kernel CVE announcement process by Greg Kroah-Hartman, signaling that maintainers have patched the affected ksmbd components and that defenders should prioritize kernel updates on systems exposing SMB services.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A separate Linux kernel CVE announcement disclosed CVE-2024-50286, describing a slab-use-after-free flaw in ksmbd's ksmbd_smb2_session_create and indicating a fix was issued.
A Linux kernel CVE announcement disclosed CVE-2024-50283, describing a slab-use-after-free flaw in ksmbd's smb3_preauth_hash_rsp and indicating a fix was issued.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A newly discussed Linux kernel flaw in the in-kernel SMB server **ksmbd** has been identified as **CVE-2025-37899**, a **use-after-free** bug triggered by a race condition during session handling. Reports say one worker thread can continue using `sess->user` while another thread processing an **SMB2 LOGOFF** request frees that structure, creating a path to memory corruption in kernels affected since **5.15**. The issue drew attention because **ksmbd** was introduced in Linux 5.15 and enabled by default from **5.16**, potentially widening exposure on systems using the feature. The disclosure follows earlier reporting on repeated security problems in **ksmbd** and other Linux networking components, including **CVE-2024-26592**, **CVE-2024-26594**, **CVE-2023-52440**, **CVE-2023-52441**, and **CVE-2023-52442**, alongside the **nf_tables** double-free flaw **CVE-2024-1086**. Prior discussions highlighted that some vulnerable code paths affected broad kernel ranges and distributions, underscoring a continuing pattern of memory-management bugs in kernel subsystems exposed through SMB and packet-filtering functionality.
Jun 29, 2026
Red Hat and the Linux kernel CVE team disclosed **CVE-2026-31709**, an Important-severity flaw in the Linux kernel SMB client’s `cifsacl` code that can be triggered by a malicious SMB server. The bug stems from insufficient validation of a server-supplied DACL during `chmod` and `chown` security descriptor handling, allowing a truncated DACL with a valid header and overstated ACE count to drive out-of-bounds reads or copies in `fs/smb/client/cifsacl.c`. Red Hat assigned the issue a CVSS v3 score of **7.8** and said successful exploitation could cause memory corruption, information disclosure, or denial of service. The vulnerable code was introduced in kernel **5.12**, and the fix adds a shared `validate_dacl()` routine with full DACL and per-ACE bounds checks, which is also reused by `parse_dacl()` for consistent validation. Red Hat said corrected kernel packages have been released across multiple product streams including **RHEL 8, RHEL 9, and RHEL 10**, while **RHEL 6** is not affected because the vulnerable code is absent; the issue is also included in **RHSA-2026:23329** for RHEL 10. Red Hat advised customers to apply the updated kernel packages and reboot affected systems, and said organizations that do not need SMB client functionality can mitigate exposure by blacklisting the `cifs` kernel module.
Aug 25, 2026
Red Hat disclosed two **Important** Linux kernel vulnerabilities in the SMB client’s `cifsacl` handling that can be triggered by a malicious SMB server and lead to memory corruption. **`CVE-2026-31709`** affects DACL parsing when a server advertises more ACEs than are actually present, causing insufficient validation and resulting in out-of-bounds memory read or copy behavior. Red Hat said the flaw can cause information disclosure or denial of service and assigned it a CVSS v3 score of **7.8**. A second flaw, **`CVE-2026-46195`**, affects **32-bit** Red Hat Enterprise Linux systems and stems from a crafted `dacloffset` value that can trigger pointer wrap during `chmod` or `chown` operations, leading to invalid DACL dereferences and memory corruption. Red Hat warned the issue could cause denial of service or bypass security mechanisms, scored it **7.5**, and mapped it to **`CWE-787`**, a class of out-of-bounds write weaknesses that can corrupt memory and potentially alter program control flow. Red Hat published fixes across multiple RHEL 8 and 9 kernel streams, noted some product variants remained affected at disclosure, and advised organizations that do not need SMB client functionality to blacklist the `cifs` kernel module as a mitigation.
Aug 25, 2026