A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Nov 18, 2024 | Nov 14, 2024 |
| Ubuntu | — | Upgrade linux-gkeUpgrade linux-awsUpgrade linux-bluefieldUpgrade linux-xilinx-zynqmpUpgrade linux-raspiUpgrade linux-lowlatencyUpgrade linux-azure-fdeUpgrade linux-kvmUpgrade linux-gkeop-5.15Upgrade linux-realtimeUpgrade linux-azureUpgrade linux-nvidiaUpgrade linux-hwe-5.15Upgrade linux-oracleUpgrade linux-lowlatency-hwe-5.15Upgrade linux-aws-5.15Upgrade linux-gcp-5.15Upgrade linux-intel-iotgUpgrade linux-intel-iotg-5.15Upgrade linux-oracle-5.15Upgrade linux-ibm-5.15Upgrade linux-gkeopUpgrade linux-nvidia-tegra-5.15Upgrade linux-nvidia-tegra-igxUpgrade linuxUpgrade linux-riscv-5.15Upgrade linux-gcpUpgrade linux-intel-iot-realtimeUpgrade linux-ibmUpgrade linux-azure-5.15Upgrade linux-nvidia-tegra | Nov 19, 2024 | Nov 14, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 24, 2025 | Nov 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub