CVE-2024-56626
kernel: ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · December 27, 2024
Updated · September 12, 2026
Description
A flaw was found in ksmbd in the Linux kernel. A remote attacker, by providing a negative offset value when the 'vfs objects = streams_xattr' parameter is set in ksmbd.conf, could trigger an out-of-bounds write. This vulnerability allows writing data outside the bounds of an allocated buffer, which may lead to arbitrary code execution.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 · Out-of-bounds Write