CVE-2024-26980 – A slab-out-of-bounds read vulnerability in the ... (How to Fix)

Q: What is the severity of CVE-2024-26980?

CVE-2024-26980 has a CVSS score of 5.5 (MEDIUM). A slab-out-of-bounds read vulnerability in the Linux kernel's ksmbd SMB server module allows attackers to read kernel memory beyond allocated buffers. This affects systems running Linux kernels with ksmbd enabled, potentially exposing sensitive kernel data. The vulnerability occurs when processing specially crafted SMB2 transform requests.

📋 TL;DR

A slab-out-of-bounds read vulnerability in the Linux kernel's ksmbd SMB server module allows attackers to read kernel memory beyond allocated buffers. This affects systems running Linux kernels with ksmbd enabled, potentially exposing sensitive kernel data. The vulnerability occurs when processing specially crafted SMB2 transform requests.

💻 Affected Systems

Products:

Linux kernel with ksmbd module

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if ksmbd module is loaded and SMB services are enabled. Many distributions don't enable ksmbd by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to information leakage, potential privilege escalation if combined with other vulnerabilities, or system instability/crashes.

🟠

Likely Case

Information disclosure of kernel memory contents, which could reveal sensitive data or aid in further exploitation.

🟢

If Mitigated

Minimal impact if ksmbd is disabled or proper network segmentation isolates SMB services.

🌐 Internet-Facing: MEDIUM - SMB services exposed to internet could be targeted, but requires specific SMB protocol access.

🏢 Internal Only: MEDIUM - Internal attackers with network access to SMB services could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to send crafted SMB2 transform requests to the ksmbd service. No public exploit code is known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 0977f89722eceba165700ea384f075143f012085, 3160d9734453a40db248487f8204830879c207f1, b80ba648714e6d790d69610cf14656be222d0248, c119f4ede3fa90a9463f50831761c28f989bfb20, da21401372607c49972ea87a6edaafb36a17c325

Vendor Advisory: https://git.kernel.org/stable/c/0977f89722eceba165700ea384f075143f012085

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load patched kernel. 3. Verify ksmbd module is using patched code.

🔧 Temporary Workarounds

Disable ksmbd module

linux

Prevent loading of the vulnerable ksmbd kernel module

echo 'blacklist ksmbd' >> /etc/modprobe.d/blacklist-ksmbd.conf
rmmod ksmbd

Restrict SMB network access

linux

Use firewall rules to limit access to SMB services

iptables -A INPUT -p tcp --dport 445 -j DROP
iptables -A INPUT -p tcp --dport 139 -j DROP

🧯 If You Can't Patch

Disable ksmbd module if not required for business operations
Implement strict network segmentation to isolate SMB services from untrusted networks

🔍 How to Verify

Check if Vulnerable:

Check if ksmbd module is loaded: lsmod | grep ksmbd. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and ksmbd module is from patched kernel. Check dmesg for any ksmbd-related errors.

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages related to ksmbd
SMB protocol errors in system logs
Unexpected SMB connection attempts

Network Indicators:

Unusual SMB2 transform protocol traffic
Multiple failed SMB connection attempts

SIEM Query:

source="kernel" AND "ksmbd" AND ("slab" OR "out-of-bounds" OR "panic")

📊 Metadata

CVE ID: CVE-2024-26980

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-125

Published: May 1, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-26980, you might also want to check these: