CVE-2023-39179: High ksmbd SMB2 Read Information Leak in Linux

CVE-2023-39179 is a High severity (CVSS 7.5) out-of-bounds read in the Linux kernel ksmbd module, in the handling of SMB2 read requests. A remote attacker could disclose memory. Only systems with ksmbd enabled are vulnerable. Install a kernel update that your distribution lists as fixed for this CVE.

What's affected

The record lists the Linux kernel with no version range. Its description states that only systems with ksmbd enabled are vulnerable. We could not confirm a fixed kernel version, because the sources reachable for this review do not name one. Use your distribution's security tracker for the exact package.

Red Hat's CVE page says no Red Hat products are affected, because the ksmbd code is not included in any shipping RHEL kernel release. If you run a Red Hat based distribution, you are out of scope unless you installed a custom kernel.

Two source notes. First, the record's ZDI reference is ZDI-24-586, which when we opened it describes CVE-2023-39176 (the transform header issue), not this read request flaw. Look for the ZDI advisory that matches this CVE before relying on its details. Second, the score is 7.5 in both the record and Red Hat's page, but the vectors differ: the record has high attack complexity and a changed scope, while NVD's has low complexity and an unchanged scope. The overall rating is High either way.

How to check if you're exposed

ksmbd is the in-kernel SMB file server. It is not the same as Samba, and many systems do not have it at all. On a Linux host, check whether the module is loaded and whether the kernel was built with it:

uname -r
lsmod | grep ksmbd
grep CONFIG_SMB_SERVER /boot/config-$(uname -r)

If lsmod shows nothing and the config line is absent or not set to m or y, ksmbd is not running on that host and this CVE does not apply. You can also check whether anything listens on the SMB port:

ss -ltn 'sport = :445'

If ksmbd is in use, compare your kernel to the fixed versions listed by your distribution. The record gives no fixed kernel version, so rely on your distribution's security tracker for the exact package.

What to do now

1. Run the checks above on servers, appliances and containers that might use the kernel SMB server.
2. If ksmbd is loaded and not needed, unload it and stop the service that starts it. Use Samba or another supported file server if you need SMB.
3. If you need ksmbd, update the kernel to a build your distribution marks as fixed for this CVE.
4. Restrict the SMB port to trusted networks with a firewall, so a network attacker cannot reach the service.
5. Keep a record of which hosts run ksmbd, so the next kernel advisory is quick to triage.

Why it matters

The record maps this to CWE-125 (out-of-bounds read). The code that answers an SMB2 read request does not properly validate user-supplied data, so a read can run beyond the end of a buffer. What comes back to the client may include kernel memory that was never meant to leave the machine.

Memory disclosure matters mostly as a stepping stone. Leaked addresses or data can help defeat protections such as address randomization, and help someone chain this with another flaw. The vector marks attack complexity as high and does not require authentication or user action. The ksmbd requirement narrows the exposure sharply, since many servers never load it. The record does not mark the CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.

Quick check

Sources

• Red Hat CVE page for CVE-2023-39179
• ZDI-24-586, listed in the record for this CVE (describes CVE-2023-39176)
• Record data for CVE-2023-39179

Last reviewed: 19 October 2026.