CVE-2024-56626

What it actually does

Negative client-supplied offset in ksmbd_vfs_stream_write permits an out-of-bounds write beyond the allocated buffer when streams_xattr is enabled in ksmbd.conf.

Why it matters to the business

Attackers may corrupt kernel memory on exposed SMB servers, leading to crashes, data integrity loss, or remote code execution on unpatched Linux systems; low but non-zero exploitation probability exists across the ecosystem.

How an attack unfolds

An attacker connects to a ksmbd instance with streams_xattr enabled, supplies a negative offset in a stream write request, and triggers the write to memory outside the intended buffer bounds.

How to fix it

Apply the kernel patch that validates offsets before the write operation; alternatively disable streams_xattr in ksmbd.conf if the feature is not required.

How to confirm the fix worked

Confirm the updated kernel version is running and test that negative offsets are rejected with an error rather than performing the write.

Typical attack path

1. Identify reachable ksmbd instance with streams_xattr enabled
2. Craft SMB2 write request containing negative offset value
3. Send request to trigger out-of-bounds write
4. Leverage resulting memory corruption for further exploitation or denial of service

How to detect it

Review ksmbd and SMB server logs for anomalous stream write operations; inspect kernel crash dumps or oops messages indicating out-of-bounds access near vfs_stream_write.

What your security team should do

• Prioritize patching Linux kernels hosting ksmbd on internet-facing or high-value systems
• Audit ksmbd.conf files for streams_xattr usage and disable where possible
• Monitor EPSS and KEV status for any increase in observed exploitation