CVE-2024-26811

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-26811", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.180Z", "datePublished": "2024-04-08T10:02:18.184Z", "dateUpdated": "2026-08-05T11:27:30.296Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:30.296Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate payload size in ipc response\n\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable parsing lives in the in-kernel SMB3 server (fs/smb/server/) and is only entered on behalf of a remote client's SMB2 SESSION_SETUP, TREE_CONNECT, or DCERPC-over-IPC$ request, and the over-read bytes are copied straight back into the SMB response sent to that client over TCP/445.\nAC:L - The kernel unconditionally trusts the embedded length fields, so no memory-layout luck is needed; where handle reuse after the 2 s IPC timeout is involved the attacker drives both sides by opening many connections and issuing concurrent requests to stall ksmbd.mountd, which the rubric treats as attacker-created and therefore Low.\nPR:N - One of the three responses this patch validates (SPNEGO_AUTHEN) is consumed inside ksmbd_krb5_authenticate() during SMB2 SESSION_SETUP, before the client's credentials are verified, and the over-read blob is written into the response returned to that unauthenticated client; the share-config and IPC$ RPC paths are additionally reachable via guest/anonymous sessions that ksmbd-tools enables by default.\nUI:N - The attacker triggers the IPC transaction entirely on their own by sending SMB2 requests to the listening server; no local user or administrator has to perform any action.\nS:U - The out-of-bounds access and its consequences are confined to the kernel that hosts the ksmbd server; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - smb2_read_pipe() memcpys rpc_resp->payload_sz bytes out of a short slab object and returns them verbatim to the client as SMB2 READ data, and ksmbd_krb5_authenticate() ships spnego_blob_len over-read bytes back in the SESSION_SETUP SecurityBuffer \u2014 a large, directly exfiltrated kernel heap disclosure.\nI:H - Because a wrong-type response is accepted and reinterpreted, security-critical state is built from out-of-bounds slab memory: ksmbd_alloc_user() derives the session's uid/gid/status flags from an OOB login_response, and share->path is kstrdup'd from bytes past the object, letting the server grant a session under an unintended identity or root a share at an unintended path.\nA:H - An unvalidated payload_sz drives kvmalloc() of an arbitrary u32 size and a matching memcpy from a much smaller allocation, so the slab-out-of-bounds read readily walks into unmapped memory and oopses the kernel (or trips KASAN/hardened usercopy), killing the SMB service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/share_config.c", "fs/smb/server/transport_ipc.c"], "versions": [{"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "88b7f1143b15b29cccb8392b4f38e75b7bb3e300", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "51a6c2af9d20203ddeeaf73314ba8854b38d01bd", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "a637fabac554270a851033f5ab402ecb90bc479c", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "76af689a45aa44714b46d1a7de4ffdf851ded896", "status": "affected", "versionType": "git"}, {"version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "a677ebd8ca2f2632ccdecbad7b87641274e15aac", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/share_config.c", "fs/smb/server/transport_ipc.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.157", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.85", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.26", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.85"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.8.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/88b7f1143b15b29cccb8392b4f38e75b7bb3e300"}, {"url": "https://git.kernel.org/stable/c/51a6c2af9d20203ddeeaf73314ba8854b38d01bd"}, {"url": "https://git.kernel.org/stable/c/a637fabac554270a851033f5ab402ecb90bc479c"}, {"url": "https://git.kernel.org/stable/c/76af689a45aa44714b46d1a7de4ffdf851ded896"}, {"url": "https://git.kernel.org/stable/c/a677ebd8ca2f2632ccdecbad7b87641274e15aac"}], "title": "ksmbd: validate payload size in ipc response", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/88b7f1143b15b29cccb8392b4f38e75b7bb3e300", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/51a6c2af9d20203ddeeaf73314ba8854b38d01bd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a637fabac554270a851033f5ab402ecb90bc479c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/76af689a45aa44714b46d1a7de4ffdf851ded896", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a677ebd8ca2f2632ccdecbad7b87641274e15aac", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6XCNJZBDMGJXRIKLGKM4RRJU4XCHPX62/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RO3RO34MLQ6WT3A7O6STQUVXW43N6W3K/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LG6L4FXO4WNWUM6W7USOH2YTRVWREM3V/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T22:06:01.323Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26811", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:50:30.655244Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:43.255Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/88b7f1143b15b29cccb8392b4f38e75b7bb3e300", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/51a6c2af9d20203ddeeaf73314ba8854b38d01bd", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a637fabac554270a851033f5ab402ecb90bc479c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/76af689a45aa44714b46d1a7de4ffdf851ded896", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/a677ebd8ca2f2632ccdecbad7b87641274e15aac", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6XCNJZBDMGJXRIKLGKM4RRJU4XCHPX62/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RO3RO34MLQ6WT3A7O6STQUVXW43N6W3K/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LG6L4FXO4WNWUM6W7USOH2YTRVWREM3V/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T22:06:01.323Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26811", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:50:30.655244Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:18.338Z"}}], "cna": {"title": "ksmbd: validate payload size in ipc response", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable parsing lives in the in-kernel SMB3 server (fs/smb/server/) and is only entered on behalf of a remote client's SMB2 SESSION_SETUP, TREE_CONNECT, or DCERPC-over-IPC$ request, and the over-read bytes are copied straight back into the SMB response sent to that client over TCP/445.\nAC:L - The kernel unconditionally trusts the embedded length fields, so no memory-layout luck is needed; where handle reuse after the 2 s IPC timeout is involved the attacker drives both sides by opening many connections and issuing concurrent requests to stall ksmbd.mountd, which the rubric treats as attacker-created and therefore Low.\nPR:N - One of the three responses this patch validates (SPNEGO_AUTHEN) is consumed inside ksmbd_krb5_authenticate() during SMB2 SESSION_SETUP, before the client's credentials are verified, and the over-read blob is written into the response returned to that unauthenticated client; the share-config and IPC$ RPC paths are additionally reachable via guest/anonymous sessions that ksmbd-tools enables by default.\nUI:N - The attacker triggers the IPC transaction entirely on their own by sending SMB2 requests to the listening server; no local user or administrator has to perform any action.\nS:U - The out-of-bounds access and its consequences are confined to the kernel that hosts the ksmbd server; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - smb2_read_pipe() memcpys rpc_resp->payload_sz bytes out of a short slab object and returns them verbatim to the client as SMB2 READ data, and ksmbd_krb5_authenticate() ships spnego_blob_len over-read bytes back in the SESSION_SETUP SecurityBuffer \u2014 a large, directly exfiltrated kernel heap disclosure.\nI:H - Because a wrong-type response is accepted and reinterpreted, security-critical state is built from out-of-bounds slab memory: ksmbd_alloc_user() derives the session's uid/gid/status flags from an OOB login_response, and share->path is kstrdup'd from bytes past the object, letting the server grant a session under an unintended identity or root a share at an unintended path.\nA:H - An unvalidated payload_sz drives kvmalloc() of an arbitrary u32 size and a matching memcpy from a much smaller allocation, so the slab-out-of-bounds read readily walks into unmapped memory and oopses the kernel (or trips KASAN/hardened usercopy), killing the SMB service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "88b7f1143b15b29cccb8392b4f38e75b7bb3e300", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "51a6c2af9d20203ddeeaf73314ba8854b38d01bd", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "a637fabac554270a851033f5ab402ecb90bc479c", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "76af689a45aa44714b46d1a7de4ffdf851ded896", "versionType": "git"}, {"status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "lessThan": "a677ebd8ca2f2632ccdecbad7b87641274e15aac", "versionType": "git"}], "programFiles": ["fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/share_config.c", "fs/smb/server/transport_ipc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.157", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.85", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.26", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8.5", "versionType": "semver", "lessThanOrEqual": "6.8.*"}, {"status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/share_config.c", "fs/smb/server/transport_ipc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/88b7f1143b15b29cccb8392b4f38e75b7bb3e300"}, {"url": "https://git.kernel.org/stable/c/51a6c2af9d20203ddeeaf73314ba8854b38d01bd"}, {"url": "https://git.kernel.org/stable/c/a637fabac554270a851033f5ab402ecb90bc479c"}, {"url": "https://git.kernel.org/stable/c/76af689a45aa44714b46d1a7de4ffdf851ded896"}, {"url": "https://git.kernel.org/stable/c/a677ebd8ca2f2632ccdecbad7b87641274e15aac"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate payload size in ipc response\n\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.157", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.85", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.26", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.5", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9", "versionStartIncluding": "5.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:30.296Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26811", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:27:30.296Z", "dateReserved": "2024-02-19T14:20:24.180Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-08T10:02:18.184Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/share_config.c", "fs/smb/server/transport_ipc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "88b7f1143b15b29cccb8392b4f38e75b7bb3e300", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}, {"lessThan": "51a6c2af9d20203ddeeaf73314ba8854b38d01bd", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}, {"lessThan": "a637fabac554270a851033f5ab402ecb90bc479c", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}, {"lessThan": "76af689a45aa44714b46d1a7de4ffdf851ded896", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}, {"lessThan": "a677ebd8ca2f2632ccdecbad7b87641274e15aac", "status": "affected", "version": "0626e6641f6b467447c81dd7678a69c66f7746cf", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/ksmbd_netlink.h", "fs/smb/server/mgmt/share_config.c", "fs/smb/server/transport_ipc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.157", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.85", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.26", "versionType": "semver"}, {"lessThanOrEqual": "6.8.*", "status": "unaffected", "version": "6.8.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.9", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "18FE1EAE-C36C-49FC-A5E0-0A661CDC561E", "versionEndExcluding": "6.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*", "matchCriteriaId": "3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*", "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate payload size in ipc response\n\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ksmbd: validar el tama\u00f1o del payload en la respuesta de ipc Si instala herramientas ksmbd maliciosas, ksmbd.mountd puede devolver una respuesta de ipc no v\u00e1lida al servidor del kernel de ksmbd. ksmbd debe validar el tama\u00f1o del payload de la respuesta ipc de ksmbd.mountd para evitar el desbordamiento de la memoria o los l\u00edmites. Este parche valida 3 respuestas ipc que tienen payload."}], "id": "CVE-2024-26811", "lastModified": "2026-08-04T11:17:09.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-26811", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:50:30.655244Z", "version": "2.0.3"}}]}, "published": "2024-04-08T10:15:08.540", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/51a6c2af9d20203ddeeaf73314ba8854b38d01bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/76af689a45aa44714b46d1a7de4ffdf851ded896"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/88b7f1143b15b29cccb8392b4f38e75b7bb3e300"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a637fabac554270a851033f5ab402ecb90bc479c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a677ebd8ca2f2632ccdecbad7b87641274e15aac"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/51a6c2af9d20203ddeeaf73314ba8854b38d01bd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/76af689a45aa44714b46d1a7de4ffdf851ded896"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/88b7f1143b15b29cccb8392b4f38e75b7bb3e300"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a637fabac554270a851033f5ab402ecb90bc479c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a677ebd8ca2f2632ccdecbad7b87641274e15aac"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6XCNJZBDMGJXRIKLGKM4RRJU4XCHPX62/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LG6L4FXO4WNWUM6W7USOH2YTRVWREM3V/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RO3RO34MLQ6WT3A7O6STQUVXW43N6W3K/"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: validate payload size in ipc response", "id": "2273967", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2273967"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nksmbd: validate payload size in ipc response\nIf installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc\nresponse to ksmbd kernel server. ksmbd should validate payload size of\nipc response from ksmbd.mountd to avoid memory overrun or\nslab-out-of-bounds. This patch validate 3 ipc response that has payload."], "name": "CVE-2024-26811", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-04-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-26811\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-26811\nhttps://lore.kernel.org/linux-cve-announce/2024040822-CVE-2024-26811-f7f5@gregkh/T"], "threat_severity": "Moderate"}

{}