CVE-2023-52442
A critical flaw in the Linux kernel’s SMB server (ksmbd) could let attackers bypass session checks in compound SMB requests, potentially gaining unauthorized access. The issue has been fixed in the kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, especially versions 6.5 and earlier that have not applied the ksmbd patch.
Real-world impact
An attacker could exploit the flaw to bypass authentication checks in SMB sessions, potentially accessing shared resources without permission.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability can be exploited remotely without authentication or user interaction, and it can lead to complete compromise of the affected system.
What to do about it
- 01Upgrade your Linux system to a kernel version that includes the ksmbd patch (e.g., 6.5 or newer).
- 02Reboot the system to load the updated kernel.
NVD description indicates patch applied.
Timeline
- Feb 21, 2024 · Feb 21, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 6, 2026 · 7h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.