The vulnerability of the smb2_sess_setup() function in the fs/smb/server/smb2pdu.c file of the Smb file system in the Linux operating system allows a attacker to compromise the integrity of protected information or cause service failures.

The vulnerability of the smb2sesssetup function in the fs/smb/server/smb2pdu.c file of the Smb kernel of the Linux operating system is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of protected information or cau...

CVE-2025-40285: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb/server: fix possible refcount leak in smb2sesssetup Reference count of ksmbdsession will leak when session need reconnect. Fix this by adding the missing ksmbdusersessionput...

CVE-2023-3867: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2sesssetup ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first...

Vulnerabilities of the functions check_session_id(), smb2_check_user_session(), smb2_sess_setup(), smb2_session_logoff(), smb3_decrypt_req(), ksmbd_session_lookup(), ksmbd_session_lookup_slowpath(), and ksmbd_get_encryption_key() in the Linux operating system kernel, allowing a hacker to cause a service failure.

The vulnerabilities of the functions checksessionid, smb2checkusersession, smb2sesssetup, smb2sessionlogoff, smb3decryptreq, ksmbdsessionlookup, ksmbdsessionlookupslowpath, and ksmbdgetencryptionkey in the Linux operating system are related to improper locking mechanisms. Exploiting these...

CVE-2025-37899: Use After Free

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in session logoff The sess-user object can currently be in use by another thread, for example if another connection has sent a session setup request to bind to the session being free'd. The handler for...

CVE-2025-37778: Use After Free

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krbauthenticate krbauthenticate frees sess-user and does not set the pointer to NULL. It calls ksmbdkrb5authenticate to reinitialise sess-user but that function may return without doing so. If that...

CVE-2024-46795: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset the binding mark of a reused connection Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding...

CVE-2023-52480 ksmbd: fix race condition between session lookup and expire

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbdsessionlookup | smb2sesssetup sess = xaload | | | xaerase&conn-sessions, sess-id; | | ksmbdsessiondestroysess -- kfreesess | // UAF! |...

UBUNTU-CVE-2023-3867

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2sesssetup ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first...