CVE-2024-49988

What it actually does

Use-after-free in ksmbd_conn struct during oplock break handling on multichannel SMB connections, where a freed conn pointer can be dereferenced.

Why it matters to the business

Servers running the Linux kernel SMB implementation risk crashes or potential remote code execution, disrupting file sharing services and exposing systems to compromise.

How an attack unfolds

An attacker establishes a multichannel SMB session to a ksmbd server, triggers an oplock break request that references a freed connection object, and leverages the resulting memory corruption for further exploitation, consistent with observed patterns in Linux kernel vulnerabilities by espionage and financially motivated actors.

How to fix it

Update the Linux kernel to a version containing commit 18f06bacc197d4ac9b518ad1c69999bc3d83e7aa or later; for Rocky Linux 8 thunderbird packages apply 0:78.13.0-1.el8_4 or newer equivalent kernel update.

How to confirm the fix worked

Verify running kernel version includes the reference count fix for ksmbd_conn; inspect source for presence of the refcnt addition and test multichannel SMB oplock scenarios for stability.

Typical attack path

1. Establish SMB connection with multichannel support enabled
2. Trigger oplock break request via file operations
3. Force or wait for connection teardown on one channel while reference remains on another
4. Access freed ksmbd_conn structure to achieve memory corruption or control flow hijack

How to detect it

Review kernel logs for oops or panic messages referencing ksmbd_conn or oplock break handling; correlate with SMB multichannel connection events and unusual memory access patterns in ksmbd.

What your security team should do

• Apply kernel updates containing the ksmbd_conn refcnt fix immediately on systems exposing SMB via ksmbd
• Disable ksmbd if multichannel SMB is not required
• Monitor for kernel oops or crashes involving ksmbd_conn during SMB activity
• Review downstream package dependencies for affected kernel versions