CVE-2023-3866
Estado: ModificadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: validate session id and tree id in the compound request
This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 11%
- Percentil entre todas las CVEs puntuadas: 96
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-476
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-3866",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"lessThan": "eb947403518ea3d93f6d89264bb1f5416bb0c7d0",
"versionType": "git"
},
{
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"lessThan": "854156d12caa9d36de1cf5f084591c7686cc8a9d",
"versionType": "git"
},
{
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"lessThan": "d1066c1b3663401cd23c0d6e60cdae750ce00c0f",
"versionType": "git"
},
{
"status": "affected",
"version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
"lessThan": "5005bcb4219156f1bf7587b185080ec1da08518e",
"versionType": "git"
}
],
"programFiles": [
"fs/smb/server/server.c",
"fs/smb/server/smb2pdu.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.121",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.36",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.3.10",
"versionType": "semver",
"lessThanOrEqual": "6.3.*"
},
{
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/smb/server/server.c",
"fs/smb/server/smb2pdu.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-08-16T14:15:27.383",
"references": [
{
"url": "https://git.kernel.org/stable/c/5005bcb4219156f1bf7587b185080ec1da08518e",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/854156d12caa9d36de1cf5f084591c7686cc8a9d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d1066c1b3663401cd23c0d6e60cdae750ce00c0f",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eb947403518ea3d93f6d89264bb1f5416bb0c7d0",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate session id and tree id in the compound request\n\nThis patch validate session id and tree id in compound request.\nIf first operation in the compound is SMB2 ECHO request, ksmbd bypass\nsession and tree validation. So work->sess and work->tcon could be NULL.\nIf secound request in the compound access work->sess or tcon, It cause\nNULL pointer dereferecing error."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ksmbd: valida el ID de sesión y el ID de árbol en la solicitud compuesta. Este parche valida el ID de sesión y el ID de árbol en la solicitud compuesta. Si la primera operación en la solicitud compuesta es una solicitud ECHO SMB2, ksmbd omite la validación de sesión y árbol. Por lo tanto, work->sess y work->tcon podrían ser NULL. Si la segunda solicitud en la solicitud compuesta accede a work->sess o tcon, se produce un error de desreferenciación de puntero NULL."
}
],
"lastModified": "2026-08-04T10:18:25.907",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D80EAC0B-0800-4E58-A184-64A1FA7F7EB2",
"versionEndExcluding": "5.15.121",
"versionStartIncluding": "5.15"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "989E8FC0-FE5E-4486-9391-FE0521B2326E",
"versionEndExcluding": "6.1.36",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E91549C-3A35-4895-992D-EAD48CAD6C38",
"versionEndExcluding": "6.3.10",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "38BC6744-7D25-4C02-9966-B224CD071D30"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76061B41-CAE9-4467-BEDE-0FFC7956F2A1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A717BA5B-D535-46A0-A329-A25FE5CEC588"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89CC80C6-F1EE-4AC7-BD21-DB3217BADE87"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "41EACEA1-FB69-4AF2-BC52-D39489858D42"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E1C36BE-F9D8-40B6-8281-5B8F9B42322D"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.4:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D6CAA59-F0EF-4E0B-8C23-EC9535008572"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}