CVE-2023-54250: 
Linux Debian vulnerability analysis and mitigation

CVE-2023-54250 is an out-of-bounds read vulnerability in the Linux kernel's ksmbd (kernel SMB server) subsystem, specifically in the decode_preauth_ctxt() function. The flaw arises because deassemble_neg_contexts() only validates the eight-byte smb2_neg_context header plus a client-controlled DataLength field against the packet boundary, which is insufficient to ensure the pneg_ctxt->HashAlgorithms field is within bounds. Affected kernel versions span from the initial commit up to the fixes introduced in Linux 5.15.145, 6.1.25, 6.2.12, and 6.3. The vulnerability was published on December 30, 2025, with an EPSS score of approximately 0.018% (very low), and no CVSS base score has been formally assigned (Feedly, EUVD).

The root cause is insufficient bounds checking (CWE-125: Out-of-bounds Read) in the ksmbd SMB3.1.1 negotiation context parsing path. When a client sends an SMB2 NEGOTIATE request, deassemble_neg_contexts() iterates over negotiation contexts and calls decode_preauth_ctxt(), but only verifies that the header plus the client-supplied DataLength fits within the packet — it does not confirm that the HashAlgorithms field of struct smb2_preauth_neg_context is itself within the packet boundary. A malicious SMB client can craft a NEGOTIATE request with a manipulated DataLength value that causes the kernel to read memory beyond the allocated SMB request buffer when accessing pneg_ctxt->HashAlgorithms. The fix adds an explicit check that the full smb2_preauth_neg_context structure (excluding the trailing SMB311_SALT_SIZE salt bytes) is within bounds before accessing its fields (Feedly, EUVD).

Successful exploitation could allow a network-adjacent or remote unauthenticated attacker to trigger an out-of-bounds memory read in the Linux kernel's ksmbd SMB server, potentially leading to information disclosure of kernel memory contents or a kernel crash (denial of service). Because ksmbd operates in kernel space, any memory exposure could leak sensitive data such as cryptographic material, credentials, or other in-memory secrets. The availability impact includes potential system instability or crash if the out-of-bounds access triggers a kernel panic (Feedly, EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2023-54250. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to send crafted SMB2 NEGOTIATE packets to a system running the ksmbd kernel module, which is not enabled by default on most Linux distributions (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability in the following stable kernel versions: 5.15.145, 6.1.25, 6.2.12, and 6.3. Users running affected kernels with ksmbd enabled should update to these or later versions. As a workaround, administrators who do not require the ksmbd kernel SMB server can unload or blacklist the ksmbd kernel module to eliminate the attack surface. Patch commits are available in the stable kernel tree (EUVD).