CVE-2024-46686

What it actually does

Null pointer dereference in smb2_new_read_req() when SMB2_read() is invoked over RDMA and the rdma_readwrite_threshold is reached, allowing potential kernel crash or memory corruption.

Why it matters to the business

Linux systems using SMB client with RDMA may experience instability or crashes during file operations, disrupting enterprise file sharing; kernel update to 6.1.108 is required for affected stable releases.

How an attack unfolds

An attacker triggers SMB2 read requests over an RDMA-enabled connection that exceed the configured threshold, causing the client code to pass NULL rdata into smb2_new_read_req() and dereference it.

How to fix it

Upgrade the Linux kernel to version 6.1.108 or apply commit 6df57c63c200cd05e085c3b695128260e21959b7; update github.com/influxdata/influxdb to 0.9.6 if that package is in use.

How to confirm the fix worked

Confirm the running kernel reports version 6.1.108 or newer, reproduce SMB RDMA reads at the threshold, and verify absence of NULL dereference in logs.

Typical attack path

1. Establish an SMB connection with RDMA transport enabled
2. Issue read operations that surpass the rdma_readwrite_threshold
3. Force execution of smb2_new_read_req() with NULL rdata pointer

How to detect it

Inspect kernel logs for oops or panic messages referencing smb2_new_read_req or RDMA read paths around the time of SMB activity.

What your security team should do

• Apply the kernel fix to 6.1.108 or equivalent stable branch immediately
• Test RDMA-enabled SMB workloads after patching
• Disable RDMA for SMB if the feature is not required