CVE-2024-26980

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to a slab-out-of-bounds read in the smb2 allocate rsp buf() function. If the ->ProtocolId is SMB2 TRANSFORM PROTO NUM, SMB2 request size validation could be skipped. If the request size is smaller than sizeof(struct smb2 query info req), a slab-out-of-bounds read can happen in smb2 allocate rsp buf(). This can be exploited to cause a denial of service. The patch allocates the response buffer after decrypting the transform request, and smb3 decrypt req() validates the transform request size to avoid the slab-out-of-bounds issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.