Critical· 9.8official fix available
CVE-2024-50286
A critical flaw in the Linux kernel’s SMB server (ksmbd) could let attackers crash the system by exploiting a use‑after‑free bug. The issue has been fixed in recent kernel releases.
publishedNov 19, 2024
last modifiedAug 4, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
19th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 3, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Linux kernel, particularly versions 6.12 and earlier that include the ksmbd component.
02
Real-world impact
An attacker could trigger a kernel crash, causing a denial of service on the affected machine.
03
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability.
04
What to do about it
official fix available
recommended steps
- 01Upgrade the Linux kernel to version 6.12 or later, which includes the ksmbd_smb2_session_create patch.
NVD-referenced vendor advisory
05
Timeline
- Nov 19, 2024 · Nov 19, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →