CVE-2024-41030

What it actually does

Improper validation of write access flags on directory opens in ksmbd allows client-supplied flags to reach may_open() and FUSE, resulting in list_add operations with NULL pointers and subsequent kernel panic via list corruption.

Why it matters to the business

Linux servers exposing SMB shares via ksmbd can experience unexpected kernel crashes and denial of service; the issue affects systems using FUSE-backed filesystems and requires kernel updates that may involve reboots.

How an attack unfolds

An attacker sends an SMB2 OPEN request for a directory that includes write-related access flags; ksmbd incorrectly adds write access before calling into the VFS/FUSE layer, triggering __list_add_valid with a NULL next pointer and causing a kernel BUG and panic.

How to fix it

Upgrade the Linux kernel to the commit 66cf853e1c7a2407f15d9f7aaa3e47d61745e361 or any later stable release that includes the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 66cf853e1c7a2407f15d9f7aaa3e47d61745e361; attempt directory opens over SMB with write flags and verify no list corruption occurs in dmesg.

Typical attack path

1. Craft and send SMB2 open request targeting a directory with write access flags
2. ksmbd applies invalid flags and calls dentry_open/fuse_dir_open
3. fuse_finish_open performs list_add with corrupted list head
4. Kernel hits BUG at lib/list_debug.c resulting in panic

How to detect it

Search kernel logs and dmesg for "list_add corruption. next is NULL" and the call trace containing __list_add_valid, fuse_finish_open, fuse_dir_open, smb2_open, and ksmbd; correlate with inbound SMB2 open requests on directory paths.

• list_add corruption. next is NULL
• kernel BUG at lib/list_debug.c:26
• __list_add_valid+0x88/0xbc
• fuse_finish_open+0x11c/0x170
• smb2_open+0xbe4/0x15a4
• handle_ksmbd_work

What your security team should do

• Apply the referenced kernel commit or newer stable version on all systems running ksmbd
• Restrict SMB access to trusted clients until patches are deployed
• Enable kernel panic logging and monitor for list_add corruption messages