Review reviewHigh

CVE-2024-50286

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create There is a race condition between ksmbd_smb2_session_create and ksmbd_expire_session. This patch add missing sessions_table_lock while adding/deleting session from global session table.

CVSS: 7
EPSS: -
CISA KEV: Not listed
Published: 2024.11.19

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= 0626e6641f6b467447c81dd7678a69c66f7746cf < f56446ba5378d19e31040b548a14ee9a8f1500ea, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < e923503a56b3385b64ae492e3225e4623f560c5b, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < e7a2ad2044377853cf8c59528dac808a08a99c72, >= 0626e6641f6b467447c81dd7678a69c66f7746cf < 0a77715db22611df50b178374c51e2ba0d58866e, >= 5.15, < 6.1.117, >= 6.2 < 6.6.61, >= 6.7 < 6.11.8, 6.12
Fixed versions: 6.1.117, 6.6.61, 6.11.8

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416