CVE-2024-50286

What it actually does

Race condition between ksmbd_smb2_session_create and ksmbd_expire_session allows slab use-after-free when adding or deleting sessions from the global table without proper locking.

Why it matters to the business

Linux systems running SMB services face risk of crashes, memory corruption, or potential remote code execution, which can disrupt file sharing operations and expose sensitive data especially on servers with high session activity.

How an attack unfolds

An attacker sends concurrent SMB2 session requests while triggering session expiration to exploit the missing lock, leading to use-after-free; contexts involving espionage and financially motivated actors targeting similar Linux kernel issues have been noted.

How to fix it

Apply the upstream kernel patch that adds sessions_table_lock during session table modifications; upgrade flashplugin-nonfree (Ubuntu:14.04:LTS) to 11.2.202.554ubuntu0.14.04.1 where applicable.

How to confirm the fix worked

Confirm kernel source includes the locking fix around session table operations and verify package version matches or exceeds the fixed release for affected distributions.

Typical attack path

1. Locate systems exposing ksmbd SMB services
2. Issue multiple overlapping SMB2 session creation and expiration requests
3. Trigger the race condition to access freed slab memory
4. Leverage memory corruption for further exploitation or denial of service

How to detect it

Review kernel logs and SMB session handling traces for signs of concurrent session create/expire operations or slab allocator warnings; correlate with any observed crashes in ksmbd contexts.

What your security team should do

• Prioritize patching kernel ksmbd components on all internet-facing or internal SMB servers
• Monitor EPSS and threat actor reports for any increase in exploitation activity
• Test the update in a staging environment before broad deployment
• Review SMB service exposure and apply least-privilege network controls