In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create There is a race condition between ksmbd_smb2_session_create and ksmbd_expire_session. This patch add missing sessions_table_lock while adding/deleting session from global session table.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/0a77715db22611df50b178374c51e2ba0d58866e cve-icon cve-icon
https://git.kernel.org/stable/c/e7a2ad2044377853cf8c59528dac808a08a99c72 cve-icon cve-icon
https://git.kernel.org/stable/c/e923503a56b3385b64ae492e3225e4623f560c5b cve-icon cve-icon
https://git.kernel.org/stable/c/f56446ba5378d19e31040b548a14ee9a8f1500ea cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html cve-icon
https://lore.kernel.org/linux-cve-announce/2024111948-CVE-2024-50286-85e9@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-50286 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-50286 cve-icon
History

Mon, 03 Nov 2025 23:30:00 +0000

Type Values Removed Values Added
References

Thu, 06 Mar 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 22 Nov 2024 14:00:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Fri, 22 Nov 2024 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Tue, 19 Nov 2024 01:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create There is a race condition between ksmbd_smb2_session_create and ksmbd_expire_session. This patch add missing sessions_table_lock while adding/deleting session from global session table.
Title ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-11-19T01:30:29.948Z

Updated: 2025-11-03T22:28:07.988Z

Reserved: 2024-10-21T19:36:19.984Z

Link: CVE-2024-50286

cve-icon Vulnrichment

Updated: 2025-03-06T16:07:58.124Z

cve-icon NVD

Status : Modified

Published: 2024-11-19T02:16:30.860

Modified: 2025-11-03T23:17:11.233

Link: CVE-2024-50286

cve-icon Redhat

Severity : Low

Publid Date: 2024-11-19T00:00:00Z

Links: CVE-2024-50286 - Bugzilla