A vulnerability in the Linux kernel ksmbd module enables unauthenticated remote attackers to cause a denial of service through improper validation of SMB2 compound request sizes.

The flaw resides in the ksmbd_smb2_check_message function, which fails to validate the size of compound SMB2 requests before reading the StructureSize2 field. An unauthenticated attacker can send a specially crafted request that forces the kernel to read memory beyond the bounds of the allocated buffer, resulting in a slab-out-of-bounds read.

The primary risk is a denial of service, where an attacker can crash the affected system by triggering a kernel panic via the ksmbd network service. Given the CVSS score of 8.2, this vulnerability is categorized as high severity because it allows unauthenticated remote exploitation, which could lead to significant system downtime and disruption of critical file sharing services.

Immediate Action: Update the Linux kernel to version 5.15.216, 6.1.183, 6.6.148, 6.12.101, or later to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for kernel-related crashes or unexpected service restarts associated with the ksmbd process.

Compensating Controls: If patching cannot be performed immediately, restrict network access to the SMB service to trusted internal segments only, as the vulnerability is accessible via the network.

Public Exploit Available: No

This vulnerability presents a significant risk to systems utilizing the ksmbd kernel module for SMB file sharing. Security teams must prioritize applying the provided kernel updates to prevent potential remote service disruption. Patching is the only effective way to fully remediate this memory safety issue.