CVE-2023-4130

ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()

In the Linux kernel, the following vulnerability has been resolved:ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION requestfrom client. ksmbd find next smb2_ea_info using ->NextEntryOffset ofcurrent smb2_ea_info. ksmbd need to validate buffer length Beforeaccessing the next ea. ksmbd should check buffer length using buf_len,not next variable. next is the start offset of current ea that got fromprevious ea.

Affected

Linux

CVSS v3.1 NVD

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1 CNA

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS

0.51% chance of exploitation in the next 30 days, 42nd percentile

Published

2025-08-16

Updated

2026-08-15

Proof-of-concept exploits (1)

• BitsByWill/ksmbd-n-day54★ · 2025-09-13

Security advisories

• https://git.kernel.org/stable/c/4bf629262f9118ee91b1c3a518ebf2b3bcb22180
• https://git.kernel.org/stable/c/79ed288cef201f1f212dfb934bcaac75572fb8f6
• https://git.kernel.org/stable/c/aeb974907642be095e38ecb1a400ca583958b2b0
• https://git.kernel.org/stable/c/f339d76a3a972601d0738b881b099d49ebbdc3a2

References

• CVE Record
• NVD entry

Related

• CVE-2023-52440