CVE-2024-26594: ksmbd: validate mech token in session setup
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate mech token in session setup
If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26594?
CVE-2024-26594 has a moderate severity rating due to its potential to allow unauthorized access through invalid token handling.
How do I fix CVE-2024-26594?
To fix CVE-2024-26594, update the Linux kernel to a version that is not affected, such as versions greater than 5.15.149, or apply the relevant patches provided by your distribution.
Which versions of the Linux kernel are affected by CVE-2024-26594?
CVE-2024-26594 affects Linux kernel versions from 5.16.0 to 6.1.75 and specific versions between 6.2.0 and 6.6.14, and versions 6.7.0 to 6.7.2.
What is ksmbd in relation to CVE-2024-26594?
ksmbd is a server implementation used in the Linux kernel that processes SMB (Server Message Block) protocol requests, which is involved in the vulnerability described in CVE-2024-26594.
What are the potential impacts of CVE-2024-26594?
The potential impact of CVE-2024-26594 includes unauthorized access or denial of service if an attacker sends an invalid mech token during a session setup.