CVE-2024-26594: Linux kernel ksmbd out-of-bounds read in session setup mech token

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh CVSS (7.1) with high confidentiality and availability impact, a network-reachable SMB service, and very high EPSS percentile, though no confirmed in-the-wild exploitation.

What it is

The Linux kernel ksmbd SMB server fails to validate the mechanism token in a session setup request, leading to an out-of-bounds read (CWE-125). The flaw is fixed by adding validation that rejects invalid mech tokens. It matters because ksmbd is reachable over the network and a malformed token can crash or expose kernel memory.

Impact

An attacker can trigger an out-of-bounds read, causing a kernel crash (denial of service) and potentially leaking kernel memory contents. The CVSS vector rates confidentiality and availability impact as high.

Attack surface

Reached through the ksmbd SMB service via a crafted session setup request containing an invalid mech token. The CVSS vector is local (AV:L) with low privileges (PR:L) and no user interaction, though the underlying service is network-facing.

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS 30-day probability is 0.50967 (98.9th percentile), indicating elevated predicted exploitation likelihood. All references are patch links only.

What to do

• Apply the upstream kernel patches referenced in the advisory (git.kernel.org stable commits) or update to a kernel release containing the fix.
• If ksmbd is not required, disable or unload the ksmbd module to remove the attack surface.
• Restrict network access to SMB/ksmbd ports to trusted hosts and segments.
• Monitor for and block malformed SMB session setup requests at the network boundary where feasible.

Detection

• Monitor kernel logs for ksmbd errors or crashes tied to session setup and mech token handling.
• Alert on unexpected ksmbd process or kernel panics on hosts running the SMB server.
• Inspect SMB traffic for session setup requests with malformed or oversized mech tokens.
• Track patch status of ksmbd-enabled hosts against the fixed kernel versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.