CVE-2024-50283
A critical memory corruption bug in the Linux kernel's SMB server component can allow attackers to crash the system or potentially execute arbitrary code. The flaw occurs when a session is freed too early during SMB authentication. The issue has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users, especially those running version 6.12 or earlier, including servers and desktops that rely on the SMB server (ksmbd).
Real-world impact
An attacker could crash the system or potentially run code with kernel privileges, leading to full system compromise.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely without authentication, with no user interaction, and can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to version 6.12 or later.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Nov 19, 2024 · Nov 19, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.