CVE-2024-26592: ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix UAF issue in ksmbdtcpnewconnection()
The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on struct tcptransport in ksmbdtcpnewconnection() function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26592?
CVE-2024-26592 is classified with a medium severity due to its potential for a use-after-free condition in the Linux kernel.
How do I fix CVE-2024-26592?
To fix CVE-2024-26592, upgrade to a patched version of the Linux kernel as recommended in security advisories.
What software is affected by CVE-2024-26592?
CVE-2024-26592 affects several versions of the Linux kernel, specifically versions between 5.15.0 and 5.15.149, 5.16.0 and 6.1.75, and additional ranges up to 6.7.2.
Is there a workaround for CVE-2024-26592?
Currently, there are no recommended workarounds for CVE-2024-26592, and updating the kernel is advised.
What is the impact of CVE-2024-26592?
The impact of CVE-2024-26592 could allow an attacker to execute arbitrary code or crash the system when exploiting the use-after-free vulnerability.