CVE-2023-39180: Medium ksmbd SMB2 Read Memory Leak in Linux

CVE-2023-39180 is a Medium severity (CVSS 4.0) memory leak in the Linux kernel ksmbd module, found in the handling of SMB2 read commands. An unauthenticated remote attacker can exhaust memory over time and cause denial of service. Only systems with ksmbd enabled are vulnerable. Apply a kernel update marked as fixed by your distribution.

What's affected

The record lists the Linux kernel without versions and notes that only systems with ksmbd enabled are vulnerable. ZDI advisory ZDI-24-589 says Linux has issued an update and links to a kernel mailing list patch message, but it does not name a fixed release. We could not confirm a fixed kernel version, so check your distribution.

Red Hat's CVE page says no Red Hat products are affected, because the ksmbd code is not included in any shipping RHEL kernel release. If you run a Red Hat based distribution, you are out of scope unless you installed a custom kernel.

The ZDI timeline shows the report went to the vendor on 18 July 2023 and the advisory was released on 10 June 2024.

This CVE has the largest score gap among the ksmbd set. The record and ZDI give 4.0 Medium. NVD's analysis, shown on Red Hat's page, scores it 7.5 High with a high availability impact. Both are shown here. If your policy follows NVD, you may be asked to treat it as High.

How to check if you're exposed

ksmbd is the in-kernel SMB file server. It is not the same as Samba, and many systems do not have it at all. On a Linux host, check whether the module is loaded and whether the kernel was built with it:

uname -r
lsmod | grep ksmbd
grep CONFIG_SMB_SERVER /boot/config-$(uname -r)

If lsmod shows nothing and the config line is absent or not set to m or y, ksmbd is not running on that host and this CVE does not apply. You can also check whether anything listens on the SMB port:

ss -ltn 'sport = :445'

If ksmbd is in use, compare your kernel to the fixed versions listed by your distribution. The record gives no fixed kernel version, so rely on your distribution's security tracker for the exact package.

What to do now

1. Run the checks above on servers, appliances and containers that might use the kernel SMB server.
2. If ksmbd is loaded and not needed, unload it and stop the service that starts it. Use Samba or another supported file server if you need SMB.
3. If you need ksmbd, update the kernel to a build your distribution marks as fixed for this CVE.
4. Restrict the SMB port to trusted networks with a firewall, so a network attacker cannot reach the service.
5. Keep a record of which hosts run ksmbd, so the next kernel advisory is quick to triage.

Why it matters

The record lists CWE-400 (uncontrolled resource consumption) and CWE-125. The ZDI description is the clearer one: the issue results from not releasing memory after its effective lifetime, so each affected read request leaves a bit of memory behind. Repeated requests can use up memory until the host slows down or fails.

This is a denial of service flaw, with no confidentiality or integrity impact in the CVSS data. No authentication is required, which is why the score gap exists: a network attacker with no account can push a file server toward exhaustion. The ksmbd requirement still limits who is exposed. The record does not mark the CVE as exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.

Quick check

Sources

• ZDI-24-589, Zero Day Initiative advisory
• Red Hat CVE page for CVE-2023-39180
• Record data for CVE-2023-39180

Last reviewed: 19 October 2026.