CVE-2024-26954

What it actually does

Out-of-bounds read from the slab allocator occurs in smb_strndup_from_utf16 when processing an SMB2 CREATE request whose NameOffset field is smaller than the request Buffer offset, allowing the ksmbd handler to read past the intended allocation boundary.

Why it matters to the business

Linux systems running the in-kernel SMB server may experience crashes or limited memory disclosure when receiving specially crafted file-open requests, potentially disrupting file-sharing services and requiring emergency kernel updates across server fleets.

How an attack unfolds

An attacker establishes an SMB session to a ksmbd-enabled target and sends an SMB2 CREATE request with a NameOffset value below the Buffer offset; the vulnerable smb2_open path then passes this offset directly to smb_strndup_from_utf16, triggering the out-of-bounds slab read.

How to fix it

Upgrade the Linux kernel to a version containing commit d70c2e0904ab3715c5673fd45788a464a246d1db or later; rebuild and reboot affected hosts, or disable the ksmbd module if SMB server functionality is not required.

How to confirm the fix worked

Verify the running kernel contains the referenced commit via 'git log' or package version checks; test SMB2 CREATE requests with deliberately low NameOffset values and confirm absence of slab-out-of-bounds warnings in dmesg.

Typical attack path

1. Connect to the target's SMB port and negotiate an SMB2 session
2. Craft an SMB2 CREATE request with NameOffset smaller than the Buffer offset
3. Send the request and observe kernel memory disclosure or slab panic
4. Repeat or chain with other primitives for further impact

How to detect it

Review kernel ring buffer and syslog for slab-out-of-bounds warnings mentioning smb_strndup_from_utf16 or smb2_create_req; correlate with inbound SMB2 CREATE traffic containing suspicious NameOffset values.

What your security team should do

• Apply the fixed kernel commit or distribution update immediately on all systems exposing ksmbd
• Audit configurations to ensure ksmbd is enabled only where SMB serving is essential
• Monitor kernel logs for slab allocation warnings related to smb2_create_req
• Plan staged rollouts and maintain fallback images until full fleet coverage is confirmed