CVE-2023-38426

What it actually does

Out-of-bounds read in ksmbd's smb2_find_context_vals when create_context name_len exceeds tag length, allowing unauthorized memory access.

Why it matters to the business

Linux systems exposing SMB shares via ksmbd risk service crashes or sensitive memory disclosure, potentially disrupting file services and exposing data on unpatched kernels.

How an attack unfolds

An unauthenticated remote attacker crafts an SMB2 create context request with an oversized name_len field and sends it to a vulnerable ksmbd server, causing the out-of-bounds read during context processing.

How to fix it

Upgrade the Linux kernel to 6.3.4 or newer; apply commit 1fe619a7d25218e9b9fdcce9fcac6a05cd62abed to ksmbd.

How to confirm the fix worked

Confirm kernel version >= 6.3.4; test SMB2 connections with oversized create_context name_len values to verify no crash or leak occurs.

Typical attack path

1. Send crafted SMB2 create context packet with name_len larger than tag
2. Trigger smb2_find_context_vals out-of-bounds read
3. Receive response containing leaked memory or cause denial of service

How to detect it

Examine kernel logs for ksmbd oops or panic messages referencing smb2_find_context_vals and inspect network captures for SMB2 packets with anomalous create_context name_len values.

What your security team should do

• Apply kernel update containing the referenced commit immediately
• Disable ksmbd if SMB server functionality is not required
• Restrict network access to ksmbd ports to trusted sources