CVE-2024-0565 is a medium severity out-of-bounds read flaw in Linux Kernel SMB Client, scored CVSS 6.8. The record lists Linux kernel 6.7 release candidates and other kernel builds, plus NetApp ONTAP tools. Apply the kernel update from your distribution. Use the steps below to confirm your exposure and plan the fix.
What's affected
The record lists Linux kernel 6.7 release candidates and other kernel builds, plus NetApp ONTAP tools. The flaw is in receive_encrypted_standard in fs/smb/client/smb2ops.c.
An integer underflow on the memcpy length in the SMB client leads to an out of bounds read and denial of service.
The CVSS vector in the record is CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, with a base score of 6.8 (Medium). KEV status: not listed in the record.
Fixed version: Apply the kernel update from your distribution. Red Hat errata such as RHSA-2024:1188 are in the record references.
How to check if you're exposed
Print the running kernel and compare it with your distribution advisory.
uname -r
# Debian or Ubuntu
apt list --installed 2>/dev/null | grep linux-image
# RHEL, Fedora and derivatives
rpm -q kernel
rpm -q --changelog kernel | grep -i CVE-2024-0565
If the changelog or your vendor advisory lists the CVE as fixed in the installed build, you are covered. Containers share the host kernel, so check the host, not the image.
What to do now
- Identify hosts and virtual machines running affected kernels.
- Install the kernel update from your distribution and reboot, or use live patching if your vendor supports it for this CVE.
- Restrict local shell access and unprivileged features where the advisory suggests it, since the flaw needs a local user.
- Rescan after patching to confirm the finding closes.
Why it matters
CWE-191 describes this class. An integer underflow happens when a subtraction produces a value below zero in an unsigned type, and the result wraps to a very large number. If that number is later used as a copy length, the code reads far more memory than intended. Length checks before the arithmetic are the usual fix.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-15.
For a wider view, a free in-browser dependency scan and the Gold directory show where Linux Kernel SMB Client sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Quick check
Is CVE-2024-0565 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Do containers need the kernel patch too?
Containers share the host kernel. Patch the host or node, not the container image.
Sources
- Safeguard Gold entry for CVE-2024-0565
- NVD record data for CVE-2024-0565, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
