In the Linux kernel, the following vulnerability has been resolved:

ksmbd: unset conn->binding on failed binding request

When a multichannel SMB2SESSIONSETUP request with SMB2SESSIONREQFLAGBINDING fails ksmbd sets conn->binding = true but never clears it on the error path. This leaves the connection in a binding state where all subsequent ksmbdsessionlookupall() calls fall back to the global sessions table. This fix it by clearing conn->binding = false in the error path.

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: avoid out of bounds access in decodepreauthctxt()

Confirm that the accessed pnegctxt->HashAlgorithms address sits within the SMB request boundary; deassemblenegcontexts() only checks that the eight byte smb2negcontext header + (client controlled) DataLength are within the packet boundary, which is insufficient.

Checking for sizeof(struct smb2preauthnegcontext) is overkill given that the type currently assumes SMB311SALTSIZE bytes of trailing Salt.

Rejected reason: This CVE ID has been rejected or withdrawn.