CVE-2024-57925

What it actually does

Missing return-value check after ksmbd_alloc_work_struct() allows a subsequent kzalloc on a NULL in_work pointer, resulting in an illegal memory write inside smb2_send_interim_resp().

Why it matters to the business

Systems running the Linux kernel with ksmbd enabled risk kernel crashes or memory corruption that can interrupt file-sharing services and require emergency reboots or patching.

How an attack unfolds

An attacker sends an SMB2 request that reaches smb2_send_interim_resp() while the kernel is under memory pressure; the allocation failure leaves a NULL pointer that allocate_interim_rsp_buf() then dereferences, writing attacker-controlled data into invalid kernel memory.

How to fix it

Apply the upstream fix in commit df0cc57e057f18e44dac8e6c18aba47ab53202f9 or later; rebuild and deploy the patched kernel; disable ksmbd if the service is not required.

How to confirm the fix worked

Confirm the running kernel contains commit df0cc57e057f18e44dac8e6c18aba47ab53202f9; exercise SMB2 interim-response code paths under memory pressure and verify absence of NULL dereference oops.

Typical attack path

1. Enable or reach a ksmbd server on the target kernel
2. Trigger memory exhaustion or allocation failure in the SMB2 interim-response path
3. Send a crafted SMB2 request that invokes smb2_send_interim_resp()
4. Cause the NULL pointer dereference and illegal write

How to detect it

Search kernel logs for oops or panic messages containing ksmbd_alloc_work_struct, smb2_send_interim_resp, or allocate_interim_rsp_buf; inspect crash dumps for NULL pointer writes originating from ksmbd.

What your security team should do

• Patch affected kernels to the fixed commit within the next maintenance window
• Disable ksmbd in kernel configuration if SMB serving is unnecessary
• Monitor for ksmbd-related kernel oops and allocation failures
• Review systems for downstream packages that ship the vulnerable ksmbd code