CVE-2024-26936

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26936
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate request buffer size in smb2_allocate_rsp_buf() The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as smb2 header is used in smb2_allocate_rsp_buf(). This patch add simple buffer size validation to avoid potencial out-of-bounds in request buffer.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/17cf0c2794bdb6f39671265aa18aea5c22ee8c4a Patch
https://git.kernel.org/stable/c/21ff9d7d223c5c19cb4334009e4c0c83a2f4d674 Patch
https://git.kernel.org/stable/c/2c27a64a2bc47d9bfc7c3cf8be14be53b1ee7cb6 Patch
https://git.kernel.org/stable/c/5c20b242d4fed73a93591e48bfd9772e2322fb11 Patch
https://git.kernel.org/stable/c/8f3d0bf1d0c62b539d54c5b9108a845cff619b99 Patch
https://git.kernel.org/stable/c/17cf0c2794bdb6f39671265aa18aea5c22ee8c4a Patch
https://git.kernel.org/stable/c/21ff9d7d223c5c19cb4334009e4c0c83a2f4d674 Patch
https://git.kernel.org/stable/c/2c27a64a2bc47d9bfc7c3cf8be14be53b1ee7cb6 Patch
https://git.kernel.org/stable/c/5c20b242d4fed73a93591e48bfd9772e2322fb11 Patch
https://git.kernel.org/stable/c/8f3d0bf1d0c62b539d54c5b9108a845cff619b99 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
History

18 Sep 2025, 14:19

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.9:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc4:*:*:*:*:*:*
CWE CWE-120
References () https://git.kernel.org/stable/c/17cf0c2794bdb6f39671265aa18aea5c22ee8c4a - () https://git.kernel.org/stable/c/17cf0c2794bdb6f39671265aa18aea5c22ee8c4a - Patch
References () https://git.kernel.org/stable/c/21ff9d7d223c5c19cb4334009e4c0c83a2f4d674 - () https://git.kernel.org/stable/c/21ff9d7d223c5c19cb4334009e4c0c83a2f4d674 - Patch
References () https://git.kernel.org/stable/c/2c27a64a2bc47d9bfc7c3cf8be14be53b1ee7cb6 - () https://git.kernel.org/stable/c/2c27a64a2bc47d9bfc7c3cf8be14be53b1ee7cb6 - Patch
References () https://git.kernel.org/stable/c/5c20b242d4fed73a93591e48bfd9772e2322fb11 - () https://git.kernel.org/stable/c/5c20b242d4fed73a93591e48bfd9772e2322fb11 - Patch
References () https://git.kernel.org/stable/c/8f3d0bf1d0c62b539d54c5b9108a845cff619b99 - () https://git.kernel.org/stable/c/8f3d0bf1d0c62b539d54c5b9108a845cff619b99 - Patch

21 Nov 2024, 09:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/17cf0c2794bdb6f39671265aa18aea5c22ee8c4a - () https://git.kernel.org/stable/c/17cf0c2794bdb6f39671265aa18aea5c22ee8c4a -
References () https://git.kernel.org/stable/c/21ff9d7d223c5c19cb4334009e4c0c83a2f4d674 - () https://git.kernel.org/stable/c/21ff9d7d223c5c19cb4334009e4c0c83a2f4d674 -
References () https://git.kernel.org/stable/c/2c27a64a2bc47d9bfc7c3cf8be14be53b1ee7cb6 - () https://git.kernel.org/stable/c/2c27a64a2bc47d9bfc7c3cf8be14be53b1ee7cb6 -
References () https://git.kernel.org/stable/c/5c20b242d4fed73a93591e48bfd9772e2322fb11 - () https://git.kernel.org/stable/c/5c20b242d4fed73a93591e48bfd9772e2322fb11 -
References () https://git.kernel.org/stable/c/8f3d0bf1d0c62b539d54c5b9108a845cff619b99 - () https://git.kernel.org/stable/c/8f3d0bf1d0c62b539d54c5b9108a845cff619b99 -

17 May 2024, 11:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/8f3d0bf1d0c62b539d54c5b9108a845cff619b99 -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: validar el tamaño del búfer de solicitud en smb2_allocate_rsp_buf() El búfer de respuesta debe asignarse en smb2_allocate_rsp_buf antes de validar la solicitud. Pero los campos en el payload y el encabezado smb2 se usan en smb2_allocate_rsp_buf(). Este parche agrega una validación simple del tamaño del búfer para evitar posibles límites en el búfer de solicitud.

01 May 2024, 13:02

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-01 06:15

Updated : 2025-09-18 14:19

NVD link : CVE-2024-26936

Mitre link : CVE-2024-26936

CVE.ORG link : CVE-2024-26936

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')