Evil-DB LogoEvil-DB
← All CVEs

CVE-2023-3866

high · 7.5

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in the compound request This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error.

7.5
CVSS
12.5%
EPSS (exploit prob.)
96th
EPSS percentile
2025-08-16
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-476

Affected products

VendorProductAffected versions
linuxlinux_kernel>= 5.15, < 5.15.121
linuxlinux_kernel>= 5.16, < 6.1.36
linuxlinux_kernel>= 6.2, < 6.3.10
linuxlinux_kernel6.4
linuxlinux_kernel6.4
linuxlinux_kernel6.4
linuxlinux_kernel6.4
linuxlinux_kernel6.4
linuxlinux_kernel6.4
linuxlinux_kernel6.4

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-3866