CVE-2024-58087 ksmbd: fix racy issue from session lookup and expire
A race condition in the Linux kernel's ksmbd module can lead to a denial of service due to improper session reference counting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-58087?
CVE-2024-58087 is a critical vulnerability in Linux kernel, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix racy issue from session lookup and expire
Increment the session reference count within the lock for lookup to avoid racy issue with session expire.
Weakness: CWE-667
Which versions are affected by CVE-2024-58087?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-58087?
Apply the vendor's patch.
Is CVE-2024-58087 being exploited?
There is no known exploitation of CVE-2024-58087 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-58087, DEBIAN-CVE-2024-58087, GHSA-2hh8-gpv5-pc93, UBUNTU-CVE-2024-58087.