CVE-2024-58087: Linux Kernel Race Condition Vulnerability

CVE-2024-58087 Overview

CVE-2024-58087 is a race condition vulnerability in the Linux kernel's ksmbd (kernel SMB server) module. The vulnerability exists in the session lookup and expire functionality, where the session reference count is not properly incremented within the lock during lookup operations. This creates a time-of-check to time-of-use (TOCTOU) race condition that can be exploited by remote attackers.

The ksmbd module is an in-kernel SMB3 server implementation designed to provide faster SMB file sharing performance compared to userspace implementations like Samba. This race condition occurs when session lookup operations and session expiration events happen concurrently, potentially allowing attackers to access stale or freed session objects.

Critical Impact

Remote attackers can exploit this race condition to potentially achieve high impact on confidentiality, integrity, and availability of affected systems running the ksmbd kernel module.

Affected Products

• Linux Kernel (multiple versions with ksmbd enabled)
• Linux Kernel 6.13-rc1
• Linux Kernel 6.13-rc2

Discovery Timeline

• March 12, 2025 - CVE-2024-58087 published to NVD
• October 01, 2025 - Last updated in NVD database

Technical Details for CVE-2024-58087

Vulnerability Analysis

This vulnerability is classified under CWE-667 (Improper Locking), which describes scenarios where a resource is not properly locked during access operations. In the ksmbd module, session management involves concurrent access to session data structures by multiple threads handling SMB connections.

The flaw occurs because the session reference count increment happens outside of the protective lock during session lookup operations. When a session lookup is performed, there's a window between checking the session validity and incrementing its reference count where the session expiration mechanism can free the session object. This creates a classic race condition that can lead to use-after-free scenarios or other memory corruption issues.

Successful exploitation requires an attacker to win the race condition, which involves network-based timing manipulation. While this adds complexity to exploitation, the vulnerability remains exploitable from a network context without requiring authentication or user interaction.

Root Cause

The root cause of this vulnerability is improper synchronization in the ksmbd session management code. Specifically, the session reference count was being incremented after the lookup completed, but outside the critical section protected by the lock. This allowed a race window where:

1. A lookup operation finds a valid session
2. The lock is released before incrementing the reference count
3. The session expiration timer fires and frees the session
4. The lookup operation attempts to use the now-freed session

The fix addresses this by ensuring the reference count increment occurs within the locked section, eliminating the race window.

Attack Vector

The vulnerability is exploitable over the network, targeting systems running the ksmbd kernel module for SMB file sharing. The attack scenario involves:

The attacker must be able to establish SMB connections to the target ksmbd server and carefully time requests to exploit the race window between session lookup and expiration. While the high complexity (network timing dependent) makes exploitation challenging, successful attacks could result in kernel-level code execution or denial of service conditions.

Since ksmbd operates in kernel space, any memory corruption resulting from this race condition has severe implications for system security and stability.

Detection Methods for CVE-2024-58087

Indicators of Compromise

• Unexpected kernel crashes or panics related to ksmbd module operations
• Anomalous SMB connection patterns with rapid session creation and termination
• Kernel log messages indicating memory corruption or use-after-free in ksmbd functions
• Increased failed SMB session establishment attempts from external sources

Detection Strategies

• Monitor kernel logs for ksmbd-related errors, particularly memory access violations or reference counting issues
• Implement network monitoring for unusual SMB traffic patterns that may indicate race condition exploitation attempts
• Deploy endpoint detection solutions that can identify kernel-level anomalies in the ksmbd module
• Use kernel debugging tools (kdump, crash) to analyze any system crashes for ksmbd-related stack traces

Monitoring Recommendations

• Enable enhanced logging for the ksmbd module to capture session management events
• Configure network intrusion detection systems to alert on suspicious SMB traffic patterns
• Monitor system stability metrics for unexplained kernel crashes on systems running ksmbd
• Implement SentinelOne's kernel-level monitoring to detect exploitation attempts targeting this vulnerability

How to Mitigate CVE-2024-58087

Immediate Actions Required

• Apply the official kernel patches as soon as possible on all systems running ksmbd
• If patching is not immediately feasible, consider disabling the ksmbd module and using alternative SMB implementations
• Restrict network access to SMB services to trusted networks and hosts only
• Monitor affected systems for signs of exploitation attempts

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability across multiple kernel versions. The fix ensures that the session reference count is incremented within the lock during session lookup operations, eliminating the race condition.

Official patches are available through the following commits:

• Commit 2107ab40629a
• Commit 37a0e2b362b3
• Commit 450a844c045f
• Commit a39e31e22a53
• Commit b95629435b84

Additional technical details are available in the Zero Day Initiative Advisory ZDI-25-100.

Workarounds

• Disable the ksmbd kernel module if SMB file sharing is not required: modprobe -r ksmbd
• Implement network segmentation to limit exposure of SMB services to untrusted networks
• Use userspace SMB implementations (Samba) as an alternative until patching is complete
• Configure firewall rules to restrict SMB port access (TCP 445) to authorized clients only

# Disable ksmbd module
sudo modprobe -r ksmbd

# Prevent ksmbd from loading automatically
echo "blacklist ksmbd" | sudo tee /etc/modprobe.d/blacklist-ksmbd.conf

# Restrict SMB access via firewall (example using iptables)
sudo iptables -A INPUT -p tcp --dport 445 -s trusted_network/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 445 -j DROP