Critical · published February 23, 2024
CVSS calls it critical at 9.1. It sits in the 98.9th percentile for exploit probability.
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate mech token in session setup
If client send invalid mech token in session setup request, ksmbd
validate and make the error if it is invalid.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 5.15.149 | 5.15.149 |
| linux/linux_kernel | ≥ 5.16.0, < 6.1.75 | 6.1.75 |
| linux/linux_kernel | ≥ 6.2.0, < 6.6.14 | 6.6.14 |
| linux/linux_kernel | ≥ 6.7.0, < 6.7.2 | 6.7.2 |