Review reviewHigh

CVE-2024-50086

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix user-after-free from session log off There is racy issue between smb2 session log off and smb2 session setup. It will cause user-after-free from session log off. This add session_lock when setting SMB2_SESSION_EXPIRED and referece count to session struct not to free session while it is being used.

CVSS: 7
EPSS: -
CISA KEV: Not listed
Published: 2024.10.29

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 0f62358ce85b2d4c949ef1b648be01b29cec667a, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < a9839c37fd813b432988f58a9d9dd59253d3eb2c, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 5511999e9615e4318e9142d23b29bd1597befc08, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < ee371898b53a9b9b51c02d22a8c31bfb86d45f0d, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 7aa8804c0b67b3cb263a472d17f2cb50d7f1a930, >= 5.15, < 6.1.114, >= 6.2 < 6.6.58, >= 6.7 < 6.11.5, 6.12
Fixed versions: 6.1.114, 6.6.58, 6.11.5

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416