CVE-2024-26980

What it actually does

Slab-out-of-bounds read in smb2_allocate_rsp_buf when SMB2 request with ProtocolId set to SMB2_TRANSFORM_PROTO_NUM has size smaller than sizeof(struct smb2_query_info_req) because size validation is skipped before decryption.

Why it matters to the business

Linux systems running ksmbd may experience kernel memory corruption leading to crashes, service denial, or potential information disclosure affecting file sharing services.

How an attack unfolds

An attacker sends a crafted SMB2 transform request with ProtocolId SMB2_TRANSFORM_PROTO_NUM but undersized payload; the skipped validation allows out-of-bounds access in response buffer allocation before smb3_decrypt_req can enforce size checks.

How to fix it

Apply the upstream fix in commit da21401372607c49972ea87a6edaafb36a17c325 or later; update to a Linux kernel version containing this patch for ksmbd.

How to confirm the fix worked

Verify kernel source contains the referenced commit or test with undersized SMB2 transform requests to confirm response buffer allocation occurs only after decryption validation.

Typical attack path

1. Send SMB2 negotiate request to identify ksmbd target
2. Craft transform header with SMB2_TRANSFORM_PROTO_NUM and small query_info payload
3. Transmit request to trigger skipped validation path in smb2_allocate_rsp_buf
4. Observe kernel oops or memory read side effects for further exploitation

How to detect it

Review kernel logs for slab-out-of-bounds warnings mentioning smb2_allocate_rsp_buf or ksmbd; inspect SMB2 traffic for transform protocol headers preceding small query requests.

What your security team should do

• Prioritize kernel upgrade to patched version across all systems using ksmbd
• Disable ksmbd if SMB server functionality is not required
• Monitor for kernel oops reports related to smb2_allocate_rsp_buf