CVE-2023-39176 is a Medium severity (CVSS 5.8) out-of-bounds read in the Linux kernel ksmbd module, found while parsing SMB2 requests that carry a transform header. A remote attacker can read memory past a buffer. Only systems with ksmbd enabled are affected. Update to a kernel your distribution marks as fixed.
What's affected
The record lists the Linux kernel without naming versions, and the advisory confirms that only systems with ksmbd enabled are vulnerable. The Zero Day Initiative advisory ZDI-24-586 says Linux has issued an update and points to a patch discussion on the kernel mailing list, but it names no fixed release. We could not confirm a fixed kernel version, so check your distribution's security tracker.
Red Hat's CVE page says no Red Hat products are affected, because the ksmbd code is not included in any shipping RHEL kernel release. If you run a Red Hat based distribution, you are out of scope unless you installed a custom kernel.
The ZDI timeline says the issue was reported to the vendor on 18 July 2023 and the advisory was released on 10 June 2024.
Scores differ by source. The record, which follows the ZDI score, is 5.8 Medium with a scope change. Red Hat's page shows the NVD base score as 7.5 with a different vector (unchanged scope, high confidentiality impact). Both are shown here because your scanner may use either.
How to check if you're exposed
ksmbd is the in-kernel SMB file server. It is not the same as Samba, and many systems do not have it at all. On a Linux host, check whether the module is loaded and whether the kernel was built with it:
uname -r
lsmod | grep ksmbd
grep CONFIG_SMB_SERVER /boot/config-$(uname -r)
If lsmod shows nothing and the config line is absent or not set to m or y, ksmbd is not running on that host and this CVE does not apply. You can also check whether anything listens on the SMB port:
ss -ltn 'sport = :445'
If ksmbd is in use, compare your kernel to the fixed versions listed by your distribution. The record gives no fixed kernel version, so rely on your distribution's security tracker for the exact package.
What to do now
- Run the checks above on servers, appliances and containers that might use the kernel SMB server.
- If ksmbd is loaded and not needed, unload it and stop the service that starts it. Use Samba or another supported file server if you need SMB.
- If you need ksmbd, update the kernel to a build your distribution marks as fixed for this CVE.
- Restrict the SMB port to trusted networks with a firewall, so a network attacker cannot reach the service.
- Keep a record of which hosts run ksmbd, so the next kernel advisory is quick to triage.
Why it matters
The record maps this to CWE-125 (out-of-bounds read). ksmbd parses SMB2 requests, and one of the fields it handles is a transform header, which is used for encrypted messages. The code does not validate the length data it receives from the client, so a read can run past the end of an allocated buffer. The result is disclosure of kernel memory.
The ZDI advisory adds a note about how such a leak is used: an attacker can combine it with other vulnerabilities to execute code in the context of the kernel. On its own, a read leaks information, which can weaken protections that depend on memory addresses staying secret. No authentication is needed to reach the code, but the service must be enabled, which is rare. The record does not mark the CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect every Linux server?
No. Only systems with ksmbd enabled are vulnerable, and many distributions do not ship or enable it. Red Hat says no Red Hat product is affected.
Why is the score 5.8 in one place and 7.5 in another?
The record follows the score from the Zero Day Initiative advisory, 5.8. The NVD analysis shown on Red Hat's page uses a different vector and scores 7.5. The flaw and the fix are the same.
Sources
- ZDI-24-586, Zero Day Initiative advisory
- Red Hat CVE page for CVE-2023-39176
- Record data for CVE-2023-39176
Last reviewed: 19 October 2026.
