Description
A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the intended anti-brute-force protection, potentially allowing attackers to conduct dictionary attacks more efficiently against user credentials or other authentication mechanisms.
Metrics
CVSS 3.1 3.7/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| — | — | < 5.15.145; >= 6.0.0, < 6.0.*; >= 6.1.0, < 6.1.29; >= 6.2.0, < 6.2.16; >= 6.3.0, < 6.3.2 |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 6 | — |
| Red Hat | Red Hat Enterprise Linux 7 | — |
| Red Hat | Red Hat Enterprise Linux 7 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
References
Timeline
- Published
- Jul 31, 2025
- Last modified
- Nov 9, 2026
- NVD status
- Deferred